RE: strange cmd.exe access

On Fri, 2003-05-30 at 17:13, Jeff Adams wrote:
> > what is strange is that the cmd.exe / root.exe stuff is half way

I reported this end of April, and VJay Larosa reported it the month before. These packets seem to be only the second packet from CodeRed attempts. They are completely stateless.

To test this and to capture more packets, I ran two Snort instances on the same segment/same box. One was configured to act only on established sessions (-z flag), the other on all traffic. The rules file only included a few IIS sigs, the snort.conf was identical.

I had the statefull instance log into the /var/log/statefull directory, the stateless instance into /var/log/stateless. After a while I compared the two and found that the stateless directory contained a few more entries. Removing the known statefull IP's from the stateless directory, I was left with those spurious second-packet-only CodeReds.

This seemed to confirm that these are indeed stateless packets (no TCP 3-way handshake, no first data packet) and occur on the wire like that (no mistakes in IDS config/logging etc). The majority seemed to be coming from China, but other sources were logged as well (i.e. USA, Turkey, etc).

After capturing and staring at this for a couple weeks, I got bored and released the packets back into the Ether. However, if you interested in repeating the experiment with Snort, I can tar up the setup I used and mail it to you.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Regards,
Frank