hack attempt?

[HQ]

I saw this in an error_log:

[Xxx Xxxl xx xx:xx:xx 2002] [error] [client xx.xx.xxx.xxx] File does not exist: /home/xxx/xxx.com/htdocs/scripts/..?¨??../winnt/system32/cmd.exe

What file is this? And why was someone looking for it?

[HQ]

Shit, the two characters between the periods ".." did not show up properly... They are in the graphic range of the ASCII code.

[Phil21]

it's whatever IIS exploit.. i.e. codered and the like. No need to worry about it as you're running apache.

-Phil

[HQ]

Yeah I knew it was a windows thing and I had nothing to worry about. I was still curious about what was going on though... I figured it was a hacker.

You'd think they'd be smarter and only try that shit on windows boxes.

[Lensman]

He's trying a Windows exploit.

[JFPdude]

It's the ever popular Nimbda virus....


Some dumb fucks still haven't cleaned it out of thier systems.

[FreeOnes]

Originally posted by HQ
I

What file is this? And why was someone looking for it?

Bill Gates was looking for some porn on your server. Don't worry

[HQ]

Hehehe, that's bastard ALWAYS steals my shit! First "picture thingys", and now my porn!


----

Interesting about the requested file above... is that the two messed up graphic characters (that showed up as these four characters for some reason "?¨??") were different on different 'hack' attempts. Wonder if it goes through all possibilities or what.

[pr0]

i get scanned for countless shit everyday

just wait till some script kiddy hits you with a exploit scanner

[HQ]

Fucking hacker:

[Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl
[Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi
[Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

[HQ]

Originally posted by pr0
just wait till some script kiddy hits you with a exploit scanner

What do you mean? I guess I get scanned all the time too, just never really analyzed the error logs until now. Do you have an auto-scan for this type of stuff?

[cyberpunk]

This shit happens all the time no worries

[Backov]

Originally posted by HQ
Fucking hacker:

[Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl
[Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi
[Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

That's not a hacker, that's a spammer looking for an unsecured formmail to abuse.

Cheers,
Backov

[HQ]

Yeah I know, still a hacker to me!

[Dreamman010]

Originally posted by Backov


That's not a hacker, that's a spammer looking for an unsecured formmail to abuse.

Cheers,
Backov

little correction:

"That's not a hacker, that's a spammer looking for an insecured formmail to send spam through."

[Vagisil]

Originally posted by Dreamman010


little correction:

"That's not a hacker, that's a spammer looking for an insecured formmail to send spam through."

you have a lot of time on your hands?

[Dreamman010]

Originally posted by Vagisil


you have a lot of time on your hands?

lol, I have this automated program that scans for those automatically

[hahmike]

what is this guys?


[Mon Jul 15 05:16:16 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/MSOffice/cltreq.asp

[Mon Jul 15 05:18:39 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/_vti_bin/owssvr.dll