Portal
Forum
Wiki
News
Einen Spammer auf frischer Tat ertappt - sehr lang
... und nu?
Bei mir spielt sich _live_ gerade folgendes Scenario ab:
In den Logfiles eines Webservers mehrt sich die Meldung
--
[Thu Jan 23 01:41:49 2003] [error] [client 138.89.73.14] script not found or unable to stat: /home/xxxxxxxx/www/cgi-bin/formmail.pl
--
Dadurch also schonmal eine IP:
--
[whois.arin.net]
Verizon Global Networks, Inc. VZGNI-PUB-2 (NET-138-89-0-0-1)
138.89.0.0 - 138.89.255.255
Verizon Internet Services VZ-DSLDIAL-MDSNNJ-6 (NET-138-89-0-0-2)
138.89.0.0 - 138.89.191.255
--
nmap bringt:
--
Starting nmap V. 2.54BETA31 ( http://www.insecure.org/nmap/ )
Host (138.89.73.14) appears to be up ... good.
Initiating SYN Stealth Scan against (138.89.73.14)
Adding open port 1461/tcp
Adding open port 389/tcp
Adding open port 1025/tcp
Adding open port 5000/tcp
Adding open port 135/tcp
The SYN Stealth Scan took 19 seconds to scan 1554 ports.
For OSScan assuming that port 135 is open and port 1 is closed and neither are firewalled
Interesting ports on (138.89.73.14):
(The 1548 ports scanned but not shown below are in state: closed)
Port State Service
80/tcp filtered http
135/tcp open loc-srv
389/tcp open ldap
1025/tcp open listen
1461/tcp open ibm_wrless_lan
5000/tcp open fics
Remote OS guesses: Windows Me or Windows 2000 RC1 through final release, Windows Millenium Edition v4.90.3000
TCP Sequence Prediction: Class=random positive increments
Difficulty=7662 (Worthy challenge)
IPID Sequence Generation: Incremental
Nmap run completed -- 1 IP address (1 host up) scanned in 33 seconds
---
Also eine Windows Kiste, die ueber port 80 spammt!?
Jetzt wollte ich noch wissen WAS der Typ bespammt. Wacker ein bestehendes formmail-spamnix.pl nach formmail.pl kopiert uns siehe da: Geht los.... Ein paar gebounced mails kommen zu mir zurueck.
Inhalt: Der beruehmt - beruechtigte Norton Anti Virus Spam:
---
[Header lass ich weg - sind eh nur meine Maschinen drin]
This is a MIME-encapsulated message
--h0N034i05891.1043280184/xxxxserver1.de
The original message was received at Thu, 23 Jan 2003 01:02:48 +0100
from xxxxxxxx@localhost
----- The following addresses had permanent fatal errors -----
c4@dzegm.com
(reason: 550 Host unknown)
----- Transcript of session follows -----
550 5.1.2 c4@dzegm.com... Host unknown (Name server: dzegm.com: host not found)
451 4.4.1 reply: read error from mailin-03.mx.aol.com.
--h0N034i05891.1043280184/xxxxserver1.de
Content-Type: message/delivery-status
Reporting-MTA: dns; xxxxserver1.de
Arrival-Date: Thu, 23 Jan 2003 01:02:48 +0100
Final-Recipient: RFC822; c4@dzegm.com
Action: failed
Status: 5.1.2
Remote-MTA: DNS; dzegm.com
Diagnostic-Code: SMTP; 550 Host unknown
Last-Attempt-Date: Thu, 23 Jan 2003 01:02:49 +0100
--h0N034i05891.1043280184/xxxxserver1.de
Content-Type: message/rfc822
Return-Path: <xxxxxxxx>
Received: (from xxxxxxx@localhost)
by xxxxserver1.de (8.11.6/8.11.6) id h0N02mj05888;
Thu, 23 Jan 2003 01:02:48 +0100
Date: Thu, 23 Jan 2003 01:02:48 +0100
Message-Id: <200301230002.h0N02mj05888@xxxxserver1.de>
To: c4@dzegm.com
From: ()
Subject: Norton`s 2003 AntiVirus blowout, instantly downloadable!
<HTML><P ALIGN=CENTER><FONT SIZE=4 PTSIZE=14 FAMILY="SANSSERIF" FACE="Arial" LANG="0"><B>NORTON ANTIVIRUS 2003 </FONT><FONT COLOR="#000000" BACK="#ffffff" style="BACKGROUND-COLOR: #ffffff" SIZE=2 PTSIZE=10 FAMILY="SANSSERIF" FACE="Arial" LANG="0">
- FULL VERSION -
DOWNLOAD IT INSTANTLY TO YOUR SYSTEM, NO WAITING FOR A CD! </B>
<P ALIGN=LEFT>
Only $29.95 (retail $49.95) for the most trusted name in Virus-Scan software!
Order Norton AntiVirus 2003 today, and enjoy your New Year virus free!
No waiting for a CD in the mail, just an instant download and a very quick and s
imple setup. Plus, order now and receive free virus updates for one full year!
Protect your computer, <A HREF="http://rd.yahoo.com/partner/2766679/overture/fir
st/OV=1/6/1/mcafee/*http://norton.logideals.com/index.cg...&oid=20&pid=49">C
lick Here to find out why Nortons is the most popular and effective Anti-Virus s
oftware in the world!</A>
To be removed from all future mailings immediately, and permanently <A HREF="htt
p://rd.yahoo.com/partner/2766679/overtur...V=1/6/1/mcafee/*http://norton.l
ogideals.com/unsubscribe/unsubscribe.cfm">CLICK HERE</A></P></P></FONT></HTML>
p4
eine Katalogbestellung liegt vor, uebermittelt von
() on Thursday, January 23, 2003 at 01:02:48
---------------------------------------------------------------------------
email: NortonAntiVirusf@comnet.com
realname: NortonAntiVirusf@comnet.com
---------------------------------------------------------------------------
--h0N034i05891.1043280184/xxxxserver1.de--
-------
So - nun meine eigentliche Frage
Was mach` ich wenn er das naechste Mal zuschlaegt und - noch wichtiger - was wenn er meine formmail-spamnix.pl findet und nicht nach formmail.pl sucht!? Ich war eigentlich der Meinung, dass die referrer Funktion im Formmail ausreichen wuerde sowas zu verhindern. Nun bin ich eines Besseren belehrt und werde mal sehen wie sich die Empfaengeradresse im Skript fest einstanzen laesst - Jemand die Loesung?
Gruss auch!
Zitieren
Lesezeichen