hack attempt? - GoFuckYourself.com

HQ · 07-15-2002, 04:29 PM

I saw this in an error_log:

[Xxx Xxxl xx xx:xx:xx 2002] [error] [client xx.xx.xxx.xxx] File does not exist: /home/xxx/xxx.com/htdocs/scripts/..?¨??../winnt/system32/cmd.exe

What file is this? And why was someone looking for it?

HQ · 07-15-2002, 04:30 PM

Shit, the two characters between the periods ".." did not show up properly... They are in the graphic range of the ASCII code.

Phil21 · 07-15-2002, 04:39 PM

it's whatever IIS exploit.. i.e. codered and the like. No need to worry about it as you're running apache.

-Phil

HQ · 07-15-2002, 05:10 PM

Yeah I knew it was a windows thing and I had nothing to worry about. I was still curious about what was going on though... I figured it was a hacker.

You'd think they'd be smarter and only try that shit on windows boxes.

Lensman · 07-15-2002, 05:12 PM

He's trying a Windows exploit.

JFPdude · 07-15-2002, 05:16 PM

It's the ever popular Nimbda virus....

Some dumb fucks still haven't cleaned it out of thier systems.

FreeOnes · 07-15-2002, 05:23 PM

Quote:

Originally posted by HQ
I

What file is this? And why was someone looking for it?

Bill Gates was looking for some porn on your server. Don't worry

HQ · 07-15-2002, 05:56 PM

Hehehe, that's bastard ALWAYS steals my shit! First "picture thingys", and now my porn!

----

Interesting about the requested file above... is that the two messed up graphic characters (that showed up as these four characters for some reason "?¨??") were different on different 'hack' attempts. Wonder if it goes through all possibilities or what.

pr0 · 07-15-2002, 06:10 PM

i get scanned for countless shit everyday

just wait till some script kiddy hits you with a exploit scanner

HQ · 07-15-2002, 06:12 PM

Fucking hacker:

[Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl
[Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi
[Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

HQ · 07-15-2002, 06:13 PM

Quote:

Originally posted by pr0
just wait till some script kiddy hits you with a exploit scanner

What do you mean? I guess I get scanned all the time too, just never really analyzed the error logs until now. Do you have an auto-scan for this type of stuff?

cyberpunk · 07-15-2002, 06:46 PM

This shit happens all the time no worries

Backov · 07-15-2002, 06:46 PM

Quote:

Originally posted by HQ
Fucking hacker:

[Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl
[Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi
[Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

That's not a hacker, that's a spammer looking for an unsecured formmail to abuse.

Cheers,
Backov

HQ · 07-15-2002, 07:20 PM

Yeah I know, still a hacker to me!

Dreamman010 · 07-15-2002, 10:40 PM

Quote:

Originally posted by Backov

That's not a hacker, that's a spammer looking for an unsecured formmail to abuse.

Cheers,
Backov

little correction:

"That's not a hacker, that's a spammer looking for an insecured formmail to send spam through."

Vagisil · 07-15-2002, 10:41 PM

Quote:

Originally posted by Dreamman010

little correction:

"That's not a hacker, that's a spammer looking for an insecured formmail to send spam through."

you have a lot of time on your hands?

Dreamman010 · 07-15-2002, 10:44 PM

Quote:

Originally posted by Vagisil

you have a lot of time on your hands?

lol, I have this automated program that scans for those automatically

hahmike · 07-15-2002, 10:45 PM

what is this guys?

[Mon Jul 15 05:16:16 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/MSOffice/cltreq.asp

[Mon Jul 15 05:18:39 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/_vti_bin/owssvr.dll

07-15-2002, 04:29 PM	#1
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	hack attempt? I saw this in an error_log: [Xxx Xxxl xx xx:xx:xx 2002] [error] [client xx.xx.xxx.xxx] File does not exist: /home/xxx/xxx.com/htdocs/scripts/..?¨??../winnt/system32/cmd.exe What file is this? And why was someone looking for it?

07-15-2002, 06:10 PM	#9
pr0 rockin tha trailerpark Industry Role: Join Date: May 2001 Location: ~Coastal~ Posts: 23,088	i get scanned for countless shit everyday just wait till some script kiddy hits you with a exploit scanner __________________ __________ Loadedca$h - get sum! - Revengebucks - mmm rebills! - webair (gotz sErVrz)

07-15-2002, 06:46 PM	#12
cyberpunk Confirmed User Join Date: Feb 2001 Posts: 1,377	This shit happens all the time no worries __________________ POST NO ADS!

07-15-2002, 04:30 PM	#2
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Shit, the two characters between the periods ".." did not show up properly... They are in the graphic range of the ASCII code.

07-15-2002, 04:39 PM	#3
Phil21 Confirmed User Join Date: May 2001 Location: ICQ: 25285313 Posts: 993	it's whatever IIS exploit.. i.e. codered and the like. No need to worry about it as you're running apache. -Phil

07-15-2002, 05:10 PM	#4
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Yeah I knew it was a windows thing and I had nothing to worry about. I was still curious about what was going on though... I figured it was a hacker. You'd think they'd be smarter and only try that shit on windows boxes.

07-15-2002, 05:12 PM	#5
Lensman GFY Chaperone Join Date: Jan 2001 Location: Adult.com Posts: 9,846	He's trying a Windows exploit.

07-15-2002, 05:16 PM	#6
JFPdude Confirmed User Join Date: Jan 2002 Location: Mountains of Western North Carolina. Posts: 4,027	It's the ever popular Nimbda virus.... Some dumb fucks still haven't cleaned it out of thier systems.

07-15-2002, 05:56 PM	#8
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Hehehe, that's bastard ALWAYS steals my shit! First "picture thingys", and now my porn! ---- Interesting about the requested file above... is that the two messed up graphic characters (that showed up as these four characters for some reason "?¨??") were different on different 'hack' attempts. Wonder if it goes through all possibilities or what.

07-15-2002, 06:12 PM	#10
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Fucking hacker: [Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: / home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl [Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: / home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi [Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: / home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

07-15-2002, 07:20 PM	#14
HQ Confirmed User Join Date: Jan 2001 Posts: 3,539	Yeah I know, still a hacker to me!

07-15-2002, 10:45 PM	#18
hahmike So Fucking Banned Join Date: May 2002 Posts: 2,488	what is this guys? [Mon Jul 15 05:16:16 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/****.com/httpdocs/MSOffice/cltreq.asp [Mon Jul 15 05:18:39 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/****.com/httpdocs/_vti_bin/owssvr.dll