[Dshield] ROOT.EXE - perl auto-responder

David McGaughey DMcGaughey at mail.ci.lubbock.tx.us
Fri Oct 19 00:30:21 GMT 2001


Greetings!

Someone may have already posted something like this, and I just missed it.
But, here's a replacement for root.exe that e-mails administrator on the
machine that is scanning for it.  It's written in perl and meant to run from
Unix/Apache.  I put it on my Apache servers to run in response to scans 
which attempt to run the real root.exe.  So, if e-mail works - then an e-mail
is sent asking the Administrator of the scanning machine to please stop.

It's amazing how many machines that are scanning for root.exe don't even
run a HTTP server, but do run SMTP...

dmc

-------------- next part --------------
A non-text attachment was scrubbed...
Name: root.exe
Type: application/octet-stream
Size: 4106 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20011018/763c1f6d/root.exe


More information about the list mailing list