SnortSnarf alert page

Source: 24.112.193.145

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

30 such alerts found using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest: 22:47:55.176705 on 05/25/2003
Latest: 20:04:44.145103 on 05/26/2003

6 different signatures are present for 24.112.193.145 as a source

2 instances of WEB-IIS _mem_bin access
2 instances of WEB-FRONTPAGE /_vti_bin/ access
4 instances of WEB-IIS CodeRed v2 root.exe access
4 instances of WEB-IIS multiple decode attempt
7 instances of WEB-IIS cmd.exe access
11 instances of WEB-IIS unicode directory traversal attempt

There are 1 distinct destination IPs in the alerts of the type on this page.

24.112.193.145 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:47:55.176705 24.112.193.145:3426 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58267 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xD448505E  Ack: 0x24DE07C4  Win: 0x4470  TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:47:56.683042 24.112.193.145:3480 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58531 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0xD47280A8  Ack: 0x2443DCBB  Win: 0x4470  TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:47:57.677622 24.112.193.145:3539 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58692 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xD4A0FA0D  Ack: 0x24AF2242  Win: 0x4470  TcpLen: 20

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:47:58.689770 24.112.193.145:3575 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58846 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xD4C07248  Ack: 0x24E245E7  Win: 0x4470  TcpLen: 20

[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:47:59.702027 24.112.193.145:3625 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:59008 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xD4EAD5BE  Ack: 0x2503C5A2  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2] 
05/25-22:48:06.702038 24.112.193.145:3790 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:60119 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xD57181DC  Ack: 0x24DD234B  Win: 0x4470  TcpLen: 20

[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2] 
05/25-22:48:10.724121 24.112.193.145:3974 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:60760 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xD607EF75  Ack: 0x251CBE61  Win: 0x4470  TcpLen: 20

[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:11.744290 24.112.193.145:4135 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:60973 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xD68D7CB6  Ack: 0x254DCB54  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:14.693237 24.112.193.145:4135 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:61406 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xD68D7CB6  Ack: 0x254DCB54  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:15.709587 24.112.193.145:4322 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:61621 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xD72582F6  Ack: 0x260A510B  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:16.741407 24.112.193.145:4362 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:61816 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xD747A74E  Ack: 0x25B07B53  Win: 0x4470  TcpLen: 20

[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:20.709632 24.112.193.145:4523 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:62339 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xD7CD12A9  Ack: 0x2661D95F  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:24.712534 24.112.193.145:4673 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:62849 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xD84CAE5A  Ack: 0x25F845E9  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/25-22:48:31.753972 24.112.193.145:4855 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:64018 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0xD8E42C94  Ack: 0x26AFA669  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:03:58.605223 24.112.193.145:1059 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:53676 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x96C986C7  Ack: 0xF8A0F7B1  Win: 0x4470  TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:02.123991 24.112.193.145:1190 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:54147 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x97386E00  Ack: 0xF86587E6  Win: 0x4470  TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:03.100482 24.112.193.145:1227 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:54300 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x9757D917  Ack: 0xF8D8D2DA  Win: 0x4470  TcpLen: 20

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:07.128585 24.112.193.145:1343 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:54769 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x97BA99A5  Ack: 0xF9642D48  Win: 0x4470  TcpLen: 20

[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:08.157261 24.112.193.145:1379 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:54947 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x97D95886  Ack: 0xF93DB7A7  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2] 
05/26-20:04:12.619343 24.112.193.145:1521 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:55482 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x98521BD9  Ack: 0xF9E54D16  Win: 0x4470  TcpLen: 20

[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2] 
05/26-20:04:23.130215 24.112.193.145:1860 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:56661 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x99714CDF  Ack: 0xFA1FDDD4  Win: 0x4470  TcpLen: 20

[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:24.191872 24.112.193.145:1899 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:56835 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x9992EB88  Ack: 0xFA44EBED  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:25.135617 24.112.193.145:1929 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:56961 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x99ACF11D  Ack: 0xFAB7D027  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:29.155584 24.112.193.145:2056 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:57448 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x9A1C1359  Ack: 0xFA5BE86C  Win: 0x4470  TcpLen: 20

[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:33.126650 24.112.193.145:2201 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:57926 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x9A96F123  Ack: 0xFAE93190  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:37.138085 24.112.193.145:2231 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58409 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x9AB11444  Ack: 0xFA8289C7  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]

[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:41.141820 24.112.193.145:2361 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:58875 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x9B1D2EDA  Ack: 0xFAB41434  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]

[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:42.178706 24.112.193.145:2474 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:59021 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x9B800120  Ack: 0xFB95DDC3  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]

[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:43.171836 24.112.193.145:2512 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:59164 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x9B9FD95E  Ack: 0xFB75686E  Win: 0x4470  TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]

[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1] 
05/26-20:04:44.145103 24.112.193.145:2546 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:59300 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x9BBA74F0  Ack: 0xFBA41536  Win: 0x4470  TcpLen: 20

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:52 2003

24.112.193.145	Whois lookup at:	ARIN	RIPE	APNIC	Geektools
	DNS lookup at:	Amenesi	TRIUMF	Princeton
	More lookup links:	Dshield	Sam Spade