Tekil Mesaj gösterimi - Saldırın bakalım nereye kadar.

Konu Saldırın bakalım nereye kadar.

31-03-2009, 00:23:30

#53

DHS

farklı bir botnet kurbanı olan bir arkadaşımız ile msn den makinesine müsade ile giriş yaptık
İl.Kr. Yerel Adres Yabancı Adres Durum
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5152 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5152 127.0.0.1:3297 CLOSE_WAIT
TCP 192.168.2.2:139 0.0.0.0:0 LISTENING
TCP 192.168.2.2:2197 207.46.110.42:1863 ESTABLISHED
TCP 192.168.2.2:2312 xxxxxbanait ip:17614 ESTABLISHED
TCP 192.168.2.2:3378 85.107.230.252:3934 ESTABLISHED
TCP 192.168.2.2:3401 85.107.230.252:53418 ESTABLISHED
TCP 192.168.2.2:3472 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3473 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3474 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3475 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3476 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3477 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3478 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3479 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3480 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3481 xxxxxbanait ip:16080 ESTABLISHED
TCP 192.168.2.2:3482 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3483 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3484 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3485 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3486 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3487 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3488 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3491 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3492 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3493 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3494 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3495 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3497 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3498 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3499 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3500 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3503 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3504 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3505 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3506 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3508 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3509 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3510 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3511 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3512 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3513 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3514 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3516 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3517 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3518 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3519 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3521 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3522 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3524 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3526 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3527 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3528 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3529 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3530 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3531 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3532 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3533 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3534 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3535 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3536 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3537 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3538 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3539 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3540 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3542 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3543 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3544 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3545 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3546 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3549 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3550 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3551 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3552 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3553 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3554 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3555 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3556 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3557 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3558 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3559 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3560 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3561 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3562 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3564 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3565 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3566 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3567 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3569 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3570 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3571 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3572 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3574 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3576 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3577 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3578 94.123.195.127:4071 ESTABLISHED
TCP 192.168.2.2:3578 207.46.26.253:7001 TIME_WAIT
TCP 192.168.2.2:3582 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3584 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3585 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3587 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3588 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3590 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3591 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3593 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3595 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3596 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:3597 212.95.50.133:80 TIME_WAIT
TCP 192.168.2.2:3598 212.95.50.133:80 ESTABLISHED
TCP 192.168.2.2:5363 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:7967 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:9539 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:18355 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:20623 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:20752 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:20985 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:25800 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:26998 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:27610 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:30821 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:36115 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:43482 192.168.2.1:55345 TIME_WAIT
TCP 192.168.2.2:65013 192.168.2.1:55345 TIME_WAIT
UDP 0.0.0.0:445 *
UDP 0.0.0.0:500 *
UDP 0.0.0.0:3379 *
UDP 0.0.0.0:3403 *
UDP 0.0.0.0:3470 *
UDP 0.0.0.0:3579 *
UDP 0.0.0.0:4500 *
UDP 127.0.0.1:123 *
UDP 127.0.0.1:1054 *
UDP 127.0.0.1:1900 *
UDP 127.0.0.1:2192 *
UDP 127.0.0.1:3854 *
UDP 192.168.2.2:9 *
UDP 192.168.2.2:123 *
UDP 192.168.2.2:137 *
UDP 192.168.2.2:138 *
UDP 192.168.2.2:1900 *
UDP 192.168.2.2:14581 *
UDP 192.168.2.2:20175 *
UDP 192.168.2.2:24780 *
UDP 192.168.2.2:34123 *
C:\Documents and Settings\mustafa>

Yukarıdaki ip adreslerinde DHS girişi olarak 10 larca bağlantı kurulmuş fakat botnet sunucusuna rastlanamadı.Sunucuda pek uzun süre duramadım.
Şuan itabari ile gelen saldırı saniyede 400 den fazla SYN bunların bir kısmı juno bir kısmı botnet

Ben asıl ana sunucuyu aslında bulduğumu düşünüyorum tellcom ana ip adresini kullanıyor.Modemine bağlı 30 bin üzeri giriş var kendi makinesini birşekilde botnet sunucusu olarak kullandığını düşünüyorum ve forum yetkililerine verdim ip adresini bakalım forumda bulabileceklermi.