1 kiddiot down - several hundred thousand to go!

This is an impromptu tutorial on tracing skiddiots - because I just found one in our logs:

Quote:

---

ClientHost LogTime Service Machine
-------------------------------------------------------------------------------
199.111.104.201 2002-06-15 17:49:30.000 W3SVC1 NTSA-SERV

ServerIP Target Parameters
----------------------------------------------------------------------------
xxx.xxx.xxx.xxx /scripts/..%5c%5c../winnt/system32/cmd.exe /c+dir

---

I'm sure we all recoginse the cook-book directory traversal explot attempted here (which failed btw). So it's a kiddiot. Let's take a quick trip to www.samspade.org :

Quote:

---

Trying whois -h whois.arin.net 199.111.104.201
VERnet (NETBLK-VERNET-CIDR1)
University of Virginia
Academic Computing Center
Gilmer Hall
Charlottesville, VA 22901
US

Netname: NETBLK-VERNET-CIDR1
Netblock: 199.111.0.0 - 199.111.255.255
Maintainer: VER

Coordinator:
Jokl, James A. (JAJ17-ARIN) [email protected]
(804) 924-0616

Domain System inverse mapping provided by:

UVAARPA.VIRGINIA.EDU 128.143.2.7
JUNO.ACC.VIRGINIA.EDU 128.143.22.119

Record last updated on 05-Apr-1994.
Database last updated on 14-Jun-2002 20:01:02 EDT.

---

So the kiddiot is (probably) a student at University of Virginia. A nasty letter to the Netblock administartor will mean that's one kiddiot who's in for a nasty shock monday morning :thumbsup: Word Up - and the word was 'busted'.

Quote:

---

Hi --

You are listed as the admin contact for the Netblock: 199.111.0.0 - 199.111.255.255

University of Virginia
Academic Computing Center
Gilmer Hall
Charlottesville, VA 22901


We monitored an attempted network intrusion from an address in your IP range today (2002-06-15). The attack, (which failed) came from IP address 199.111.104.201 at 17:49:30(GMT). The actual attack attempted was a simple directory traversal expolit against a command line.

I would be grateful if you could take appropriate sanctions against the student involved. Someone obviously considers themselves to be 'l33t' - perhaps you could explain to them that under new US legislation that such exploits are classed as terrorism.

Regards,

---

lol, good work. This is exactly what all of you should do when something like this happens: don't retaliate with DoS or something, just turn them in. It does so much more damage, hehe.

Nice post ntsa. You can also view this approach as keeping the arcane knowledge to the select few smart enough, who already know it, or, who are more intelligent than to do crap like this. :)

i'm gonna try that, sounds like fun =) I get attempted "hack-ins" all the time so it should be fun to get them back in a legal way. lol

I was just wondering if you had got a response the netblock admin about this and what they had to say about it?

so let me get this straight...
everytime my zone alarm/visualzone report alerts me to someone trying to scan my box or something like that i can report them....??
i would be a busy guy i think..

Cool tutorial ntsa! :)

turning someone in is good but how do you get them kicked if they are just some pre-pubescant sub7 user sitting behind his comp and Dos-ing random sites can you screw them just because they tried to ping flood you?

Isn't this an attack from some Nimda/Code Red infected MS server ??? I get hundreds of these a month .... sorted the problem with mod_antihak for Apache .... adds the infected servers IP to iptables and blocks them at the first attempt .... saves filling the logs with this stuff.

Check it out at ..

http://apantihak.sourceforge.net/

this Apache module actually came rolled up in the lasted Mandrake Linux release.

Another gem from my log file --

Has anyone seen any advisory relating to an attack against ADSAdClient31.dll? I don't have this .dll (I wrote my own banner software ;)) and I have never seen it in the wild. Parameters of the GET request passed to the (non-existant) .dll were:

Quote:

---

GetAd?PG=HOTBOS?SC=LG?HM=04514b47584b101e551e3b4719110440696909163a4513244c125b515f5244194149616d?LOC=I?TF=adframe?PUID=00014C60E6AC87BE?UC=1

---

Does this look like an attempted buffer-overflow attempt to anyone? Am I now dealing with someone a bit more serious or is this another cook-book expoit that I'm unaware of? Opinions? Only one hit in the log so I guess this attempt wasn't up close and personal - so it was probably some sort of vulnerability scanner iterating through an IP range.

IP origonates in Germany - Any ideas before I turn him in?

w00t!

I got this response back from the net block admin - Just thought I'd post it to let everyone know that this approach works...

Quote:

---

-----Original Message-----
From: James A. Jokl [mailto:[email protected]]
Sent: 17 June 2002 06:11
To: Simon Barnett
Cc: [email protected]; [email protected]
Subject: Re: Network attack originating from your network.


199.111.104.x is owned and operated by the library of virginia.
www.lva.lib.va.us

I have copied them on this email.

---

Actually, I find this quite mean...

You just screwed someones life up, you could have found your own ways to put a scare in that student, instead of getting him completely banned from college.

Quote:

---

Originally posted here by Phactorial
Actually, I find this quite mean...

You just screwed someones life up, you could have found your own ways to put a scare in that student, instead of getting him completely banned from college.

---

Well, you tell me what you would do if someone came to your house, went to every door and window and shook and rattled the thing to see if they could open it. Would this be some person that you would want to "go talk to" and calmly tell them the error of their ways, or would like to take out a gun and threaten them with it and "put a scare in to them" hoping that they, in-turn, don't have a gun... or would you rather call the police and have them possibly come lecture them on the wrongs that they are commiting?

<edit>
BTW, great post, ntsa... as usual.

Please note, however, that many of these cmd.exe and system32 robo-searches are, rather than be k1dd10ts could possibly be an IIS worm trying to "make friends" and the like with other servers... to think, from now until basically enternity there'll be these stupid M$ worms roaming the Internet, always eating up a chunk of bandwidth. That is, at least, until free speech and communication has been made illegal. *chuckle*
</edit>

Quote:

---

Originally posted here by leadbelly
so let me get this straight...
everytime my zone alarm/visualzone report alerts me to someone trying to scan my box or something like that i can report them....??
i would be a busy guy i think..

---

hmm I shouldn't do that... ZA picks up many things as 'attacks' it can also be some broadcast or misconfigured routers causing your ZA to react. Only notify an ISP when it's clear that it's an attack (like in the case of NTSA) or when several approaches come from the same IP (or small IP range). that's IMHO.

About replies from isp net admins, yep they do reply. A while ago I had a scriptkiddie trying stuff against my boxes (unsuccesfull) and I did the same as NTSA. I mailed to the IP adress block owner abuse adress. And they replied with thanks to notify, they gave me the e-mail adress of the real owner and I never saw that IP again on my logs. Some ISP's / admins care ;) .

I am with draziw he should'nt be hacking against a private computer in the first place.As for getting banned from college I think they will prob just ban him from the college computers.Anyway....,who would be dumb enough to hack from a college computer?:rofl:.




-Sh4d0wX

Oh yeh i forgot to ask......,how do you view those type of log files on a WinXp and Win98 systems?




-Sh4d0wX

I wonder if someone gets banned cause if I read correctly in NTSA post it was a library computer... therefor anyone can use those comps to scan some IP's,
or the library is infected with the Nimda / codeRed worm.... poor M$ systems

quote:
GetAd?PG=HOTBOS?SC=LG? HM=04514b47584b101e551e3b4719110440696909163a45132
44c125b515f5244194149616d?LOC=I?TF=adframe?PUID=00014C60E6AC87BE?UC=1

Turn in him!!
this look like an attempted buffer-overflow attempt to me

i have a dedicated server in germany and i recieve all sorts of hack attempts from all over the world but especially from canada and germany. the problem with reacting like ntsa is that most of the attacks originate from huge isp networks with thousands, nearly millions, of users. a simple email informing the admin does change anything-- their wont even identify the user which scanned.

here: several attempts a day on my ded:

Quote:

---

[Sat Jun 15 06:18:19 2002] [error] [client 208.245.147.50] Client sent malformed Host header
[Sat Jun 15 14:09:51 2002] [error] [client 65.94.72.106] Client sent malformed Host header
[Sat Jun 15 16:19:27 2002] [error] [client 213.67.12.82] Client sent malformed Host header
[Sat Jun 15 21:04:50 2002] [error] [client 217.162.164.98] Client sent malformed Host header
[Sun Jun 16 02:30:59 2002] [error] [client 81.72.230.164] File does not exist: /home/httpd/html/scripts/..%5c%5c../winnt/system32/cmd.exe
[Sun Jun 16 03:56:42 2002] [error] [client 81.72.230.164] File does not exist: /home/httpd/html/scripts/..%5c%5c../winnt/system32/cmd.exe
[Sun Jun 16 06:22:16 2002] [error] [client 81.72.230.164] File does not exist: /home/httpd/html/scripts/..%5c%5c../winnt/system32/cmd.exe
[Mon Jun 17 02:36:35 2002] [error] [client 212.84.99.228] Client sent malformed Host header
[Mon Jun 17 04:22:37 2002] [error] [client 217.52.98.105] Client sent malformed Host header

---

@ntsa: referring to germany isps:

if the attacts you registered from germany were coming from networks like t-online.de, t-dialin.net or anything like t-something you wont even be able to change anything. (same goes for hansenet.de)

the german telekom has millions of users and clients all over the world. the will not react and response to your emails and probably not even trace the little hacker......... almost scripts-kiddies-paradise

excellent post, ntsa!

Quote:

---

Originally posted here by Sh4d0wX
Oh yeh i forgot to ask......,how do you view those type of log files on a WinXp and Win98 systems?
-Sh4d0wX

---

In XP (IIS6) it should be similar to IIS5. Try this:
1...Open the MMC and select the site you wish to log.
2...Right click | properties
3...In the 'web site' tab click enable logging
4...Select where you want to log to (ODBC database or textfile)
5...Set the ODBC properties (if neccecary) by clicking the properties option
6...Click Ok | ok

Under Win98 peer (or should that read poor ;)) web server I have no idea - but I can't see that it would be all that different - look for logfile settings in the properties of the site with whatever web admin tool ships with Win98.

Phorax,

of all the ISP's that i regularly send examples and IP's to, :rolleyes: , the german ISP's tend to actually do something.
e.g:
- English Version -
Dear Sir or Madam

We received and analysed your e-mail.
The causer is a customer of T-Online.
Therefore we sent your complaint to

T-Online International AG
mailto:[email protected]
Tel.: 06151/680-0
abuse-Team

Kind regards
Deutsche Telekom AG
security team Ulm


I have almost given up sending abuse emails to S.E.Asian ISp's. Although actually Ringing up an Internet Cafe in India and telling them to get their User offline did the trick once. Expensive, but very satisfying :p

Although from my experience, trying to do that to a university student(in a lab per se)... is a waste of time. A lot of times students do the administration. I know when I'm doing it.. I'm more concerned about the girl in the skirt then what some kid is trying to do. You'll have plenty more success with ISP's i'm sure ;)

I don't know, we take security pretty serious on this campus. We require each student to login and if we were to get such a complaint, we would know exactly who did it and where we can find them. Lab assistants have no power, all they have to do is make sure students log out and occasionally reboot the computers. We also record all activity in the labs so that if someone were to forget to logout and another were to use that computer, we can find out. Well that and it keeps kids from opening computers and taking the RAM home with them.

/scripts/..%5c../winnt/system32/cmd.exe 164 549892
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/c ... 44 0
/scripts/..Á../winnt/system32/cmd.exe 42 140826
/scripts/winnt/system32/cmd.exe 42 140826
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/c ... 41 137473
/scripts/..%2f../winnt/system32/cmd.exe 41 137473
/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../ ... 41 137473
/scripts/winnt/system32/cmd.exe 42 140826
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/c ... 41 137473
/scripts/..%2f../winnt/system32/cmd.exe 41 137473
/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../ ... 41 137473
/msadc/..%5c../..%5c../..%5c../winnt/system32/cmd. ... 8 26824
/Rpc/..%5c..%5c..%5cwinnt/system32/cmd.exe 8 26824
/PBServer/..%5c..%5c..%5cwinnt/system32/cmd.exe 8 26824
/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe 8 26900
/MSADC/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe 6 20118
/scripts/..%5c%5c../winnt/system32/cmd.exe 4 13412
/adsamples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/sys ... 4 13450
/samples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/syste ... 4 13450
/scripts/..%2f..%2f..%2f..%2fwinnt/system32/cmd.ex ... 4 13450
/iisadmpwd/..%2f..%2f..%2f..%2f..%2f..%2fwinnt/sys ... 4 13450
/scripts/..Á..Á..Á..Áwinnt/system32/cmd.exe 4 13450
/images/..%5c..%5cwinnt/system32/cmd.exe 3 10059



That's only the number of hits that came up more than once. I have probably 2 or 3 hundred other URL's like it. BTW: the first number after the url is the # of hits, the 2nd number is number of bytes sent.

What a waste of space.

If only I had the time to send out 600 emails to ISP admins. :)

as a simple follow-up, i noticed the following entry. Unfortunately these are my webstats as provided by my ISP, so I don't know who did what, but I did find this stat relating to above posts about xxx.de ISP's.

80.132.120.101 - p50847865.dip.t-dialin.net 307 915369

Somebody had a nifty little tool that tried every possible little attack to try to get my cmd.exe :)

sorry, havent been on for a while...
just to get this clear:
the deutsche telekom ag provides our telephone lines and t-online which by the way is a telekom subsidiary provides the internet connection and services itself.

now that you mailed to the telekom ag, E-1, they just forward it to the t-online abuse centre who then wont do anything (did you receive an answer?! :)).

"security team Ulm" sounds gooood, but does not do anything...

Phorax,

True, i havent heard from them.

I havent seen any IP's from that block attacking me either.

thats pretty good--
what sys are you using?
do you have any active firewall in which you could disable a block of ips or so? comes handy to just block the whole t-dialin block or like i do it: dynamically put the ips from where scans/ attack origin in the hosts.deny -file... you cant do better, no more attacs from that ip for ever :))

Quote:

---

Originally posted here by leadbelly
so let me get this straight...
everytime my zone alarm/visualzone report alerts me to someone trying to scan my box or something like that i can report them....??
i would be a busy guy i think..

---

No, port scans are not illegal. Actual attempted exploits are, which is what happened in NTSA's example.

Quote:

---

Originally posted here by ntsa
Does this look like an attempted buffer-overflow attempt to anyone? Am I now dealing with someone a bit more serious or is this another cook-book expoit that I'm unaware of? Opinions? Only one hit in the log so I guess this attempt wasn't up close and personal - so it was probably some sort of vulnerability scanner iterating through an IP range.

IP origonates in Germany - Any ideas before I turn him in?

---

Umm, I don't think it's an overflow, it looks like a session identifier. If it is an overflow, that's one hell of a small buffer. You're looking at like, 64 bytes (which, coincidentally is the length of two MD5 sums, which are regularly used for session tracking).

Normally a buffer overflow attempt will contain unicode strings. Look at the Nimda and CRI & II exploit logs for an example of what I mean. Usually it's like %00%505%203 kinda **** (that could be gibberish, I don't know Unicode that well).

I usually wait till I know the attacker has a static IP before I email the person responsible for the network where the attack came from. I had one IP trying to SSH into one of my Linux boxes the other week and I noticed that he kept it up so I sent a short and sweet email to the admin and lo-and-behold I haven't seen his IP pop up in my logs lately......I think it matters who the admin is on the other side...if he/she is professional they will do something about it since they wouldn't want kiddies messin' with their servers,etc.....

Regards.

Hey NTSA when I first put up my server, I got about 250 hits, which is more than my friend get ins a month, and I got that many in about 2 hour. So I checked the logs and found somebody trying traversal exploits but they used a proxy and I don't think xitami tried to log their IP too hard. Is there any way to trace them back?