welcome to Nimda, the cleaning agent of windows IIS servers, (also known as
a worm/virus)
this is a feature of windows designed to facilitate the accumulation of
zombie servers for hackers the world over.
every nimda infected server spends its days broadcasting itself to the
internet at large by trying to find other servers to hack..
I have a shell script here that I got from someone (possibly here, or
possibly the snort list, can't remember)
This script goes though your httpd logs looking for lines like those below,
and creates ipchains rules to block them..
(this could be easily converted to IPTABLES rules for anyone that wants
to.. )
all you need to do is copy it to a file on your system (I called mine nimda
as I figured that was appropraite), make it executable, then make a file
called "blocked" in /var/tmp (type: touch /var/tmp/blocked )
Then use crontab to run the script regurlarly, (the more often the less
traphic you will get from infected servers)
I run mine every 5 minutes, but I have a 1.4 gig so you may choose less then
that...
Thats it,, it will scan the logs, keep the IP of any boxes asking for
cmd.exe root.exe Admin.dll and default.ida and add the ip to
/var/tmp/blocked as well as creating a ipchain rule to block the server from
scanning you...
(The blocked file, is there so that your server doesn't try to block the
same servers more then once. if the IP is in /var/tmp/blocked, it is assumed
to be already blocked so no action is taken.
rgds
Frank
Here is the Script... (Its messy, but it works..)
==================================================
#!/bin/sh
#
# Block sites which originate Nimba queries from Apache server
# Apache must be configured with HostnameLookups Off
LOGS=/var/log/httpd
cd $LOGS
grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
awk '/system32\/cmd\.exe/ {sub(/[^:]*:/,"");print $1}' |
sort -u |
while read host
do
if ! fgrep $host /var/tmp/blocked >/dev/null
then
echo $host >>/var/tmp/blocked
/sbin/ipchains -I input -s $host -j DENY -l
fi
done
# Block sites which originate Nimba queries from Apache server
# Apache must be configured with HostnameLookups Off
#LOGS=/var/log/httpd
#cd $LOGS
grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
awk '/scripts\/Admin\.dll/ {sub(/[^:]*:/,"");print $1}' |
sort -u |
while read host
do
if ! fgrep $host /var/tmp/blocked >/dev/null
then
echo $host >>/var/tmp/blocked
/sbin/ipchains -I input -s $host -j DENY -l
fi
done
grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
awk '/MSACD\/Admin\.dll/ {sub(/[^:]*:/,"");print $1}' |
sort -u |
while read host
do
if ! fgrep $host /var/tmp/blocked >/dev/null
then
echo $host >>/var/tmp/blocked
/sbin/ipchains -I input -s $host -j DENY -l
fi
done
grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
awk '/scripts\/root\.exe/ {sub(/[^:]*:/,"");print $1}' |
sort -u |
while read host
do
if ! fgrep $host /var/tmp/blocked >/dev/null
then
echo $host >>/var/tmp/blocked
/sbin/ipchains -I input -s $host -j DENY -l
fi
done
grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
awk '/default\.ida/ {sub(/[^:]*:/,"");print $1}' |
sort -u |
while read host
do
if ! fgrep $host /var/tmp/blocked >/dev/null
then
echo $host >>/var/tmp/blocked
/sbin/ipchains -I input -s $host -j DENY -l
fi
done
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Newbie
Sent: Saturday, 6 October 2001 12:38 AM
To: [EMAIL PROTECTED]
Subject: [newbie] We hate "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?
What is up with this?
adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500]
"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 "-"
"-"
adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500]
"GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 "-"
"-"
adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500]
"GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 "-"
"-"
How do I block these boogerbutts out
of my server?
I hate them, would some kind person please
tell me how to block them out?
I would be very grateful.
nimda-scanner
Want to buy your Pack or Services from MandrakeSoft?
Go to http://www.mandrakestore.com
