Add new Bookmark
Do you need some help? Enter your problem or question below and an Exhibited Guru will get back to you. If you have a serious problem, it might be best to ask a moderator instead by selecting "Mod Box" from the drop down. Remember, this isn't for reporting bugs.



L41 SA AMF h4_src=DOS.[CRv1].ida

Back Assign Food Feed
Heal
Battle Enclosure Refresh Image Next

Basics

Care

Biology

Skills

Relationships

Design

Name
h4_src=DOS.[CRv1].ida
Species Gender Age
Herrerasaurus Male 84 (34 years old)
Owner Breeder
UnwrittenTale (#3511) UnwrittenTale (#3511)
Contract
This dinosaur has no contract tied to it.
Notes
~{ Code Red } ~

© - Wikpedia

HELLO! Welcome to http://www.wrm.com! Hacked By Chinese!

The worm exploited a vulnerability in the indexing software distributed with IIS, described in Microsoft Security Bulletin MS01-033,[3] for which a patch had been available a month earlier.

The worm spread itself using a common type of vulnerability known as a buffer overflow. It did this by using a long string of the repeated character 'N' to overflow a buffer, allowing the worm to execute arbitrary code and infect the machine. Kenneth D. Eichman was the first to discover how to block it, and was invited to the White House for his discovery.[4]

Days 1-19: Trying to spread itself by looking for more IIS servers on the Internet.

Days 20–27: Launch denial of service attacks on several fixed IP addresses. The IP address of the White House web server was among those.

Days 28-end of month: Sleeps, no active attacks.

When scanning for vulnerable machines, the worm did not test to see if the server running on a remote machine was running a vulnerable version of IIS, or even to see if it were running IIS at all. Apache access logs from this time frequently had entries such as these:

GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNN
%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3
%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0

The worm's payload is the string following the last 'N'. Due to a buffer overflow, a vulnerable host interprets this string as computer instructions, propagating the worm.