[Xitami] some beginners questions ;-)

Sun, 26 May 2002 17:49:54 +0200

----- Original Message -----
From: "Klaus Lehmann" <lehmann_klaus@t-online.de>
To: <xitami@lists.xitami.org>
Sent: Sunday, May 26, 2002 5:53 PM
Subject: [Xitami] some beginners questions ;-)

> hi
>
> forgive me, but I've don't found any faq from this list (does
> there exist any faq?); or I can't receive a archive (=all posted
> msg's; is it possible to get old msg's???)
>
> ok. please would You have a friendly view on my questions and
> small problems? thanxks.
>
>
> my system: w2k (sp2 + srp1) with 200 mb ram. all (old ;-)) scsi.
> proxyserver: ken! from german AVM -adls-; it is 23,99 hours
> online ;-)
> ddns: dynamic ip-adresse with a little help from www.dyndns.org
>       (you can try: allegro-berlin.dyndns.org with beginners:
> www oder ftp)
> web_server_solution: xitami last beta for w2k (not as service,
> normal gui with starting form autostart)
>
>
> my problems: (forword)
> (maybe I'm too silly; I've read all the faq, I've read all the
> docu's, I've asked other people [they don't know and don't want
> to get in contact with xit. ;-(  ] ... nothing has helped....
> I 'must' use this solution, because I want to work in future
> with avanti and allegro-c ; but this would be another story...
> ;-) )
>
>
> my problems:
>
> a. theres no possibility to see my server from outside. I can't
> ping it. with http and or ftp-commands I can't get in touch with
> my lovely small machine...
>

> b. others can see! ???
> here's some loggings from errors.log:
> 217.231.115.47 - - [26/May/2002:14:21:20 +0100] "GET
> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c
> ../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:21 +0100] "GET
> /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:21 +0100] "GET
> /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:21 +0100] "GET
> /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:21 +0100] "GET
> /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:25 +0100] "GET
> /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
> 404 -1 "" ""
> 217.231.115.47 - - [26/May/2002:14:21:25 +0100] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:08:37 +0100] "GET
> /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:08:43 +0100] "GET
> /MSADC/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:08:48 +0100] "GET
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:08:53 +0100] "GET
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:08:59 +0100] "GET
> /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
> -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:09:04 +0100] "GET
> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c
> +dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:09:09 +0100] "GET
> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c
> +dir HTTP/1.0" 404 -1 "" ""
> 217.85.68.156 - - [26/May/2002:15:09:15 +0100] "GET
> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c
> ../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
>
> nearly every hour there are those entriess, or every half an
> hour. hmmm.
> do they are 'scrip kiddies' ?????
> why can THEY see me?
> and I can't see my home server, If I'm outside on another place
> (=workingplace or so) ?

These loggings are caused by infected ISS servers which are now trying to
infect your server and many others. These attemps are of no harm for you
because we dont use the vulnerable Microsoft server software ;-) And believe
me, I have exactly the save loggings and I sleep well! The infected servers
try every IP-address with a certain scope and jumps with increments of one
from IP address to IP address and then look for an active server on that IP
address. So they dont use your domain name! but only your IP address to
reach you. So your server is there!

>
>
>
> I think, errors are on MY side. but where?
>
>
>
> thank You for Your help.
> Yours
> Klaus
>
>
>
>
>
> -
> Klaus Lehmann
> eMail: lehmann_klaus@t-online.de
> phone: 030-8950 3156; mobil 0173-953 7843
> adress: D-10961 Berlin; Schleiermacherstr. 13
>
> Admin Netware/WinNT/VöBB Friedrichshain-Kreuzberg,
> Allegro-C-Dienstleistungen (Datenbankbereinigungen,
> safer shells, Fehlerindices, Fremddatenimport/Export),
> Novell Netware, WindowsNT-Server,
> Batchprogrammierung & andere Automatismen.
>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>