[Xitami] Re: Access Log

[xitami@lists.xitami.org]

Yep, I got hit with these a couple of weeks ago too.

209.250.128.133 - - [08/Jun/2001:10:14:18 -0500] "GET 
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.0" 404 0

209.250.128.133 - - [08/Jun/2001:10:14:19 -0500] "GET 
/msadc/..%e0%80%af../..%e0%80%af../..%e0%80%af../winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.0" 404 0

 From what I can tell, I think someone tried to use holes in
either MS Personal Web Server or IIS to exploit your server.
I'd guess IIS, since they tried to run a command using the
interpreter located in c:\winnt, meaning you were running
Windows 2000 or NT.

61.139.59.73 - - [08/Jun/2001:16:38:03 -0500] "GET http://www.yahoo.com/ 
HTTP/1.1" 404 0

I bet some script was just looking to see if you were running
a web server; if you have a telnet server installed on your
machine, try telnetting into port 80, and type:
GET http://www.yahoo.com
with two CRLFs after it.  This should produce the same error
as this one in your access.log.

And as for the last one, I have no clue, sorry.

Whatever you come up with, I'd be interested to hear about.
Also, everything I said above is just guesses; corrections
and clarifications would be welcome from anyone.

-Dan Orzechowski
xbonesgt@cc.gatech.edu
http://xbones.resnet.gatech.edu
O is for OLIVE, run through with an awl.