On Sun, Aug 05, 2001 at 05:03:52PM +1200, Craig Jansen wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Sun, 05 Aug 2001 16:51, you wrote:
> > 15+ per day? I just checked and I'm getting one every two minutes on
> > average. (httpd wasn't running and I wasn't monitoring the port until
> > just today)
>
> Over the past 24 hours My server's been hammered with requests. Currently
> it's logging 6 every 5 minutes..
>
The new one with the 'X' seems rather interesting.
The NEW and IMPROVED worm installs a Telnet server which you can
access with the a simple HTTP Get request.
Simply collect some "hits" with your favorite firewall log, and you
have the IPs of "open" IIS servers. If you then telnet to port 80 at
that IP, and give the command right command, you receive a system
prompt.
GET /scripts/root.exe HTTP/1.0.
Nice stuff. :/
--
Hal B
[EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
Spamtrap: [EMAIL PROTECTED] and [EMAIL PROTECTED]
--
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
