[Xitami] combat against cmd.exe

[Robert J. DeMartini]

Thanks for the heads up... I didn't have a server up during the Nimda days
but am well aware of this thing now. As with all the words of warning I have
my ftp secured and have a firewall (did that before I did anything else
actually), I was actually wondering if there was a way for the server to
block access to these attackers BEFORE they show up in my log. Judging from
what I've read I guess they will just pile up in the logs and continue to
try and hack the server. (bastardos)

Thanks,

Rob


----- Original Message -----
From: "eric hamel" <erh51@yahoo.com>
To: <xitami@lists.xitami.org>
Sent: Monday, July 01, 2002 7:15 AM
Subject: Re: [Xitami] combat against cmd.exe


> From what I've seen and read this is a Nimda attack
> that's looking for an IIS server to nail. You don't
> have to worry about it with Xitami. You should see my
> logs! You get so you can even find the variations of
> nimda <LOL>.
>
> If you want an excersize in frustration. Then track
> down the servers admin and send them a letter about
> it. But don't be surprised if it ends up in the trash
> (using reciept requests). Most of them seem to ignore
> them completely.
>
> I'd watch for ftp hacking attempts and definitely
> setup a firewall to protect yourself.
>
> Good Luck.
> Eric
> --- "Robert J. DeMartini"
> <robdemartini@mindspring.com> wrote:
> > Hello,
> >
> > I'm interested to know what others are doing with
> > Xitami to combat against
> > this outside attack:
> >
> > /scripts/..%5c../winnt/system32/ cmd.exe
> > /scripts/..%5c../winnt/ system32/cmd.exe?/c+dir
> >
> > and this:
> >
> > /scripts/..%5c../httpodbc.dll
> >
> > Shows up in my log files often. I'm assuming this is
> > a NT vulnerability?
> > Since I'm not running NT it's a fruitless attack but
> > am concerned about
> > other attacks I may encounter in the future and want
> > to know if there is
> > built in precautions.
> >
> > Thanks,
> >
> > Rob
> >
> >
> > --
> > Xitami Users Mailing List -- For Xitami support
> > To unsubscribe:
> http://lists.xitami.org/mailman/listinfo/xitami
>
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami