OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Jon-o Addleman (jonathan.addlemanmcgill.ca)
Date: Fri Jul 20 2001 - 16:40:06 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Fri, Jul 20, 2001 at 12:15:46PM -0600, Don Papp spake thusly:
    > I wonder if I have seen this variant - a person I emailed has a
    > server whose web pages served looks a lot like the Code Red worm's output
    > (1 line of simple html) displaying
    >
    > FUCK CHINA GOVERNENT
    > and p0isonb0x (or something like that)
    >
    > On a black background. The web files themselves are untouched.

    I think this was something else - maybe a similar worm, but it used
    a different attack:

    "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+copy+c:\winnt\system32\cmd.exe+c:\inetpub\scripts\
    shell.exe" 404 -

    The machine that sent that to me had that same web page up, and I
    also got one from a different IP (on the same subnet) a few hours
    before that. That was a week ago though - July 13... 

    -- 
Jon-o Addleman