The small tale of one line from an access log.

[lullysing]

( NOTE : This is a small tale of what happens when you get a bored person like me, who happens to run a small personal .org webserver and a pretty much empty CS server , and suddenly have nothing to do and it's late at night, and you just happen to notice that something weird is in the logs....
It's pretty much within the stuff for this kind of group, you'll see. )

It's late. I can't sleep. I work in *checks watch* 4hours and 40 minutes. I check to see if people went to the webpage today. Tail the log, and suddenly i see this oddity right there :
[sub]220.170.88.7 - - [28/Dec/2003:04:12:47 -0500] "GET

http://www.yahoo.com/

HTTP/1.1" 200 1203[/sub]

Now, between you, me and the bum living on the corner downtown... i KNOW that yahoo.com is sure as hell not being directed towards my humble fixed IP abode... so immediatly the line shines like a chrismas tree in the middle of a forest.

The hell is that from, I ask myself...
[sub]whois 220.170.88.7
% [whois.apnic.net node-2]
% Whois data copyright terms

http://www.apnic.net/db/dbcopyright.html

inetnum: 220.168.0.0 - 220.170.255.255
netname: CHINANET-HN
descr: CHINANET Hunan province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
[/sub]

Riigghhttt....So somebody in china thinks i'm interesting ? Fat chance. Oh well....you poke me, i poke you back.

[sub]nmap 220.170.88.7
Starting nmap (

http://www.insecure.org/nmap/

) at 2003-12-28 05:56 EST
Interesting ports on 220.170.88.7:
(The 1627 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
80/tcp open http
135/tcp filtered loc-srv
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
593/tcp filtered http-rpc-epmap
1025/tcp open NFS-or-IIS
1027/tcp open IIS
1433/tcp open ms-sql-s
1755/tcp open wms
3372/tcp open msdtc
5631/tcp open pcanywheredata
6666/tcp open irc-serv
8080/tcp open http-proxy
Nmap run completed -- 1 IP address (1 host up) scanned in 14.763 seconds[/sub]

Well.... banzai i guess. Whoever is running that mobo down over there is being massively idiotic , stupid, or both. Notice the IRC , FTP and pcanywhere server.... ooohh... shiny.<i> By now, i know something is definitly not norma about this thing. I decide to investigate </i>

The webpage shows chineese gliberish. the https site doesn't seem to be connecting. FTP server ? let's see...

[sub]ftp anonymous@220.170.88.7
Connected to 220.170.88.7.
220 Serv-U FTP Server v4.0 for WinSock ready...
530 Sorry, no ANONYMOUS access allowed.
ftp: Login failed.
ftp> quit
221 Goodbye![/sub]

Ok... so there's no anonymous logins here. Mmmm....What kind of ftp server is this trick running anyhow ? You know what ? When in doubt, always remember that google is your friend (

http://www.google.ca/search?hl=en&ie=ISO-8859-1&q=serv-U+ftp+v4.0+exploit&meta=

). And behind result number two, we find our answer (

http://archives.neohapsis.com/archives/ntbugtraq/2002-q2/0121.html).

Pretty interesting what you can learn from one line at the end of your access logs, huh? Interesting note is that this appears to be over a year and a half old and yet still right on the money.

Alright... this is the end of the smallish experience. Discuss.

_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.

 

[nopscti]

That was too high funda for me. Could you please explain what happened?

Thanks,

nopscti

 

[lullysing]

Looking thru the logsfor my webserver, someone requested yahoo.com thru my own webserver...which knowing how DNSes work, makes it very hard to believe.

Then comes a little bit of investigation.

_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.

 

[nopscti]

Thanks.

 

[netbuster]

Just a quick question, you are obviously using linux for a webserver but how do you know the other guy was using linux and what FTP he was using (as you were looking for an exploit for a specific linux FTP program)
SO did you have a trojan (like that link states)... what was the exploit? ANything intresting on the ftp sever?
I think i might just have made a complete ass of myself and not having a clue what i am talking but we all have to learn......
(I dont pretend i am any sort of an expert and i came to this forum to learn, so any mistakes/wrong advice or complete crap you see that i have posted then feel free to correct me/tell me im talkin out of my ass so i can learn..but plz no Flames.)
Cheers

 

[lullysing]

The other guy was running off a version of windows ( probably NT or 2000 ) because of the responses i got from the scan, the FTP banner i got ( in general, *anything* for winsock == windows).The whole ms-sql also kinda gave it away.

Connecting to his FTP server by doing the command
&quot;ftp anonymous@IPADDRESS&quot; you get the server banner, and you will get to see if anonymous access has been permited ( in this case, not, but i got the version number).

The webpages i found while looking for the exploit revelated this is a rootkit that is at least 1 year old for NT based systems. anything running off an IRC server/bot i get very suspicious... especially when it comes to cracked boxes.

_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.