FYI - Havij Exploit response
Got a note for DOE JC3 indicating that on Dec 26 there was a Havij SQL injection attack attempt from 130.185.217.253 against 140.221.6.95 Digging into the logs, here are a few of the attempts they are making. 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:15:59 -0600] "GET /research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E HTTP/1.1" 200 24760 "-" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" [Thu Dec 26 08:16:08 2013] [error] [client 130.185.217.253] File does not exist: /www/www.mcs.anl.gov/content/research/LANS/people/\\"http:, referer: http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:08 -0600] "GET /research/LANS/people/%5C%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515... HTTP/1.1" 404 9767 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:08 -0600] "GET /uploads/cels/images/people/satish_balaysm.png HTTP/1.1" 200 122321 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:09 -0600] "GET /uploads/cels/images/people/Jie%20Chen.jpg HTTP/1.1" 200 11993 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/constantinescu-e_400.jpg HTTP/1.1" 200 31451 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/p_hovland.png HTTP/1.1" 200 146016 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" I'm concerned that the referer links in some of these appear to be coming from MCS server with defiantart links in it. Possibly others as well. --Gene
Is there any reason believe those referrer links are genuine? -- Craig (mobile) -----Original Message----- From: [email protected] [[email protected]] Received: Tuesday, 31 Dec 2013, 1:38PM To: [email protected] [[email protected]] CC: Rackow, Eugene A. [[email protected]] Subject: FYI - Havij Exploit response Got a note for DOE JC3 indicating that on Dec 26 there was a Havij SQL injection attack attempt from 130.185.217.253 against 140.221.6.95 Digging into the logs, here are a few of the attempts they are making. 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:15:59 -0600] "GET /research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E HTTP/1.1" 200 24760 "-" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" [Thu Dec 26 08:16:08 2013] [error] [client 130.185.217.253] File does not exist: /www/www.mcs.anl.gov/content/research/LANS/people/\\"http:, referer: http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:16:08 -0600] "GET /research/LANS/people/%5C%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515... HTTP/1.1" 404 9767 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:16:08 -0600] "GET /uploads/cels/images/people/satish_balaysm.png HTTP/1.1" 200 122321 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:16:09 -0600] "GET /uploads/cels/images/people/Jie%20Chen.jpg HTTP/1.1" 200 11993 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/constantinescu-e_400.jpg HTTP/1.1" 200 31451 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" 130.185.217.253 www.mcs.anl.gov<http://www.mcs.anl.gov> - [26/Dec/2013:08:16:10 -0600] "GET /uploads/cels/images/people/p_hovland.png HTTP/1.1" 200 146016 "http://www.mcs.anl.gov/research/LANS/people/index.php?p=%3Ccenter%3E%3Ch1%3E%3Cfont%20color=%22green%22%20size=%228%22%3EDONI%3C/font%3E%3C/font%3E%3C/h1%3E%3Cbr%3E%3Ch1%3E%3Cfont%20color=%22red%22%3EHexagone%3C/font%3E%3C/h1%3E%3Cbr%3E%3Cimg%20src=%22http://fc02.deviantart.net/fs71/f/2012/146/d/8/anonymous_by_deiby_ybied-d515ebr.gif%22%3E%3Cbr%3E%3Ci%3E[|%20Pinoy%20Vendetta%20|%20Philippine%20Cyber%20Army%20|%20Family%20Pride%20|]%3C/i%3E%3Cbr%3E" "Mozilla/5.0 (Windows NT 6.1; rv:26.0) Gecko/20100101 Firefox/26.0" I'm concerned that the referer links in some of these appear to be coming from MCS server with defiantart links in it. Possibly others as well. --Gene
Not really. Yet, I wonder why they would mess with the referer stings unless there is something they have that would be processing them to infect the machine or somehow present a different page to the reader. It's odd. "Stacey, Craig J." made the following keystrokes: Is there any reason believe those referrer links are genuine? -- Craig (mobile)
participants (2)
-
rackow＠anl.gov -
Stacey, Craig J.