Only thing I have seen as far as attempts to attack a web server is the following from an apache server:
(ip addy masked, although I did see some from a 10 addy)
10.10.18.109 - - [19/Jul/2001:09:03:53 -0400] “GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0” 404 205 “-” “-”
I’m still not sure what this exploit does, other than return a strange error page, not a 404 on an MS IIS system, but more like a “failed SQL query” page on the ones I’ve tested. I’ve not had enough time to further this exploit.
As for the payload of these items, some of the systems that attempted this seemed to be unpatched for the exploit regarding getting a root shell. Of the ones I had been able to see the exploit on, there was an exe in the scripts directory called root.exe, which turns out to be a copy of cmd.exe.
In short, I would assume that if the boxes in question had that exploit any number of payloads(timebombs) could have been deployed.
I just figure I’ll put up a page called Default.ida on Apache server, some ads and start charging for the hits…
Just my 2¢s
-Joe