hack attempt?
 

I saw this in an error_log:

[Xxx Xxxl xx xx:xx:xx 2002] [error] [client xx.xx.xxx.xxx] File does not exist: /home/xxx/xxx.com/htdocs/scripts/..?¨??../winnt/system32/cmd.exe

What file is this? And why was someone looking for it?

Shit, the two characters between the periods ".." did not show up properly... They are in the graphic range of the ASCII code.

it's whatever IIS exploit.. i.e. codered and the like. No need to worry about it as you're running apache.

-Phil

Yeah I knew it was a windows thing and I had nothing to worry about. I was still curious about what was going on though... I figured it was a hacker.

You'd think they'd be smarter and only try that shit on windows boxes.

He's trying a Windows exploit.

It's the ever popular Nimbda virus....


Some dumb fucks still haven't cleaned it out of thier systems.

:BangBang: :BangBang:

Bill Gates was looking for some porn on your server. Don't worry

Hehehe, that's bastard ALWAYS steals my shit! First "picture thingys", and now my porn!


----

Interesting about the requested file above... is that the two messed up graphic characters (that showed up as these four characters for some reason "?¨??") were different on different 'hack' attempts. Wonder if it goes through all possibilities or what.

i get scanned for countless shit everyday

just wait till some script kiddy hits you with a exploit scanner :1orglaugh

Fucking hacker:

[Mon Jul 15 20:27:33 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.pl
[Mon Jul 15 20:27:37 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgi-local/formmail.cgi
[Mon Jul 15 20:27:42 2002] [error] [client 65.239.145.53] File does not exist: /
home/xxxx/xxxxxx/xxxxx/cgibin/formmail.cgi

What do you mean? I guess I get scanned all the time too, just never really analyzed the error logs until now. Do you have an auto-scan for this type of stuff?

This shit happens all the time no worries

That's not a hacker, that's a spammer looking for an unsecured formmail to abuse.

Cheers,
Backov

Yeah I know, still a hacker to me! :)

little correction:

"That's not a hacker, that's a spammer looking for an insecured formmail to send spam through."

you have a lot of time on your hands?

lol, I have this automated program that scans for those automatically :thumbsup

what is this guys? :)


[Mon Jul 15 05:16:16 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/MSOffice/cltreq.asp

[Mon Jul 15 05:18:39 2002] [error] [client 195.22.11.214] File does not exist: /usr/local/psa/home/vhosts/******.com/httpdocs/_vti_bin/owssvr.dll