[Dshield] Linux Exploit Search

lucy@lucindrea.com lucy at lucindrea.com
Thu Nov 10 00:05:42 GMT 2005


or one client useing differnt proxies / zombies


> What's particularly troubling here is that there are three different
> clients following the exact same pattern.
>
> [Tue Nov 08 18:44:40 2005] [error] [client 154.37.34.90] script not found
> or unable to stat: /var/www/cgi-bin/awstats
> [client 154.37.34.90] script '/var/www/tqmcube/xmlrpc.php' not found or
> unable to stat
> [Tue Nov 08 18:44:43 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/blog
> [Tue Nov 08 18:44:44 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/blog
> [Tue Nov 08 18:44:46 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/blogs
> [Tue Nov 08 18:44:47 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/drupal
> [Tue Nov 08 18:44:48 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/phpgroupware
> [Tue Nov 08 18:44:49 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/wordpress
> [client 154.37.34.90] script '/var/www/tqmcube/xmlrpc.php' not found or
> unable to stat
> [Tue Nov 08 18:44:51 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/xmlrpc
> [Tue Nov 08 18:44:52 2005] [error] [client 154.37.34.90] File does not
> exist: /var/www/tqmcube/xmlsrv
> [Tue Nov 08 19:50:58 2005] [error] [client 68.238.145.19] script not found
> or unable to stat: /var/www/cgi-bin/awstats
> [client 68.238.145.19] script '/var/www/tqmcube/xmlrpc.php' not found or
> unable to stat
> [Tue Nov 08 19:51:01 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/blog
> [Tue Nov 08 19:51:02 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/blog
> [Tue Nov 08 19:51:03 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/blogs
> [Tue Nov 08 19:51:04 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/drupal
> [Tue Nov 08 19:51:05 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/phpgroupware
> [Tue Nov 08 19:51:06 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/wordpress
> [client 68.238.145.19] script '/var/www/tqmcube/xmlrpc.php' not found or
> unable to stat
> [Tue Nov 08 19:51:09 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/xmlrpc
> [Tue Nov 08 19:51:10 2005] [error] [client 68.238.145.19] File does not
> exist: /var/www/tqmcube/xmlsrv
> [Tue Nov 08 20:29:10 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scgi-bin
> [Tue Nov 08 20:29:13 2005] [error] [client 80.177.217.209] script not
> found or unable to stat: /var/www/cgi-bin/awstats
> [Tue Nov 08 20:29:15 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scgi-bin
> [Tue Nov 08 20:29:16 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/cgi
> [Tue Nov 08 20:29:17 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scgi
> [Tue Nov 08 20:29:19 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scripts
> [Tue Nov 08 20:29:20 2005] [error] [client 80.177.217.209] script not
> found or unable to stat: /var/www/cgi-bin/awstats
> [Tue Nov 08 20:29:21 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scgi-bin
> [Tue Nov 08 20:29:27 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/scgi-bin
> [Tue Nov 08 20:29:27 2005] [error] [client 80.177.217.209] script not
> found or unable to stat: /var/www/cgi-bin/stats
> [Tue Nov 08 20:29:28 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/stats
> [client 80.177.217.209] script '/var/www/tqmcube/xmlrpc.php' not found or
> unable to stat
> [Tue Nov 08 20:29:34 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/xmlrpc
> [Tue Nov 08 20:29:36 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/xmlsrv
> [Tue Nov 08 20:29:39 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/blog
> [Tue Nov 08 20:29:39 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/drupal
> [Tue Nov 08 20:29:45 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/blogs
> [Tue Nov 08 20:29:47 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/community
> [Tue Nov 08 20:29:48 2005] [error] [client 80.177.217.209] File does not
> exist: /var/www/tqmcube/blogs
> --
> Our DNSRBL - Eliminate Spam: http://www.TQMcube.com/spam_trap.htm
>               RBLDNSD HowTo: http://www.TQMcube.com/rbldnsd.htm
>             Multi-RBL Check: http://www.TQMcube.com/rblcheck.htm
> Tired of spam? Do YOUR part: http://www.BoulderPledge.org
>
> _________________________________________
> Using .Net? Need to know more about .Net Security?
> http://isc.sans.org/banner_count.php?dest=dotnet
>
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
>



More information about the list mailing list