[Xitami] what's this?

[Matthias Versen]

Tom Baker wrote:

>> Questions about the logs   On a few IP's that show up I get blocks of hits
>> that look like what is below.
>>
>> Any ideas as to what this is?  A hacker or?????
>>
>> Thanks for any info!
>>
>> Jim Wooddell
>>
>> here is what I am seeing in my ac logs....
>>
>> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
>> /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
>> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
> /MSADC/root.exe?/c+dir
>> HTTP/1.0" 404 -1 "" ""
> 
> Code Red/ Code Red 2 worm is trying to exploit a hole in IIS. So the machine
> at 12.225.139.174 is infected, and is trying to infect you. Since you are
> not running IIS, this should not be a problem. Everybody gets these. If
> you're running Windows, make sure that everything is patched.
> The requests will show up as errors in your error log.

It's not Code Red....

Code Red Version 2 :
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20 
HTTP/1.0" 404 -1 "" ""

(Version I use many "N")

Code Red V2 installs a backdoor (copy cmd.exe into the CGI-Directory of 
the server and rename it to root.exe). You can run all commands on an 
infected Server.

This here :
217.83.192.168 - - [25/May/2003:03:06:42 +0100] "GET 
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 ""

is a "script Kiddie" trying to find an infected server.

 >If you're running Windows, make sure that everything is patched.
a) You need only a Code Red patch if you use IIS (but Xitami is not 
affected)
b) An unpatched Linux system is equal to an unpatched Windows system

Matthias