34

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports

System.Web.HttpException: A public action method 'muieblackcat' was not found on controller...

This is obviously an attempt to access a page that doesn't exist. But why are there attempts to access this page?

Is this an attack or is it simply a bot scanning to see if I've been infected? What exactly is 'muieblackcat' and why is there an attempt to access this URL?

1
  • 14
    FYI muie means blowjob in Romanian. Feb 1, 2012 at 9:44

4 Answers 4

26

It is just a hole finder script. The requests made are typically the following ones, if your servers answers all with a 404 error, you do not have anything to worry about.

111.221.1.140 - - [20/Nov/2013:10:15:56 +0000] "GET //xampp/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:55 +0000] "GET //websql/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:55 +0000] "GET //web/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:54 +0000] "GET //web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:53 +0000] "GET //typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:51 +0000] "GET //scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:50 +0000] "GET //pma/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:49 +0000] "GET //phpmyadmin2/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:48 +0000] "GET //phpmyadmin1/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:47 +0000] "GET //phpmyadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:47 +0000] "GET //phpadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:46 +0000] "GET //phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:45 +0000] "GET //phpMyAdmin-2/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:44 +0000] "GET //phpMyAdmin-2.5.5/index.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:44 +0000] "GET //phpMyAdmin-2.5.5-pl1/index.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:43 +0000] "GET //php-my-admin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:42 +0000] "GET //mysqladmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:41 +0000] "GET //mysql/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:41 +0000] "GET //myadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:40 +0000] "GET //dbadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:39 +0000] "GET //db/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:38 +0000] "GET //admin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:37 +0000] "GET //admin/pma/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:36 +0000] "GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:35 +0000] "GET //MyAdmin/scripts/setup.php HTTP/1.1" 404 1787 "-" "-"
111.221.1.140 - - [20/Nov/2013:10:15:34 +0000] "GET /muieblackcat HTTP/1.1" 404 1787 "-" "-"
1
  • 3
    Agree. Im watching that right now and sending a report to abuse emai. My next step is a csf script that does it for me. I will spam abuse emails on each attack :D
    – m3nda
    May 3, 2015 at 15:25
10

muieblackcat is script/bot, supposedly of Ukrainian origin, that attempts to exploit PHP vulnerabilities or misconfigurations. See SUC027: Muieblackcat setup.php Web Scanner/Robot for more detail.

If you are not using PHP and have deactivated mod_php, you're safe. However, a request for /muieblackcat may mean that the bot has already, maybe successfully, visited your site. I suggest you carefully check your configuration and web content (if possible, erase all and reinstall from a trusted source set).

On the other hand, the originating IP address is likely to be useless. Most attacks come from unaware infected Windows users.

2
  • 1
    Why would you want to reinstall?
    – Clément
    Mar 2, 2016 at 16:01
  • 1
    Because it can be difficult to make sure there are absolutely no traces left after a cleanup, and only one overlooked php file is all it needs to resurrect. Wiping the installation and restore from known-good will be more thorough.
    – Cornelius
    Nov 3, 2016 at 15:36
4

I do it another way - redirect them on theirs IP on the same URI. Somethig like this:

redirect301 = http://hackerIP/muieblackcat

I think it's easier for the server to send a 301 redirect than to return a 404 page each time.

3

According to Daily Update Summary 6/24/2011 (Emerging Threat Pro blog), it's a scanner which is looking for some breaches in your server; it's definitely an intruder that you should block. Look for your access logs, you should get its IP address.

1
  • 13
    Why block them? It's a free pentest. Use the attack profile to enhance your security. They're going to have a new IP 5 minutes from now anyway. ;)
    – Dan
    Aug 7, 2015 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .