Är det någon som försöker att hacka min webbserver .??

RanXeroXMedlem sedan maj 2000829 inlägg

Frågan10 jan. 2002 08:58#1

Tjenare..

Jag kör Apache som webbserver på min linux-box, ( slackware 8.0 )
när jag kollade /var/log/apache/error_log , ,
Så såg jag detta:
(en del av felmedelanderna)

[Tue Jan 8 21:00:17 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan 8 21:00:18 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%2f../winnt/system32/cmd.exe
[Tue Jan 8 21:39:11 2002] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Tue Jan 8 21:39:12 2002] [notice] Apache/1.3.20 (Unix) configured -- resuming normal operations
[Tue Jan 8 21:44:57 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/root.exe
[Tue Jan 8 21:44:58 2002] [error] [client 213.113.15.103] File does not exist: /home/www/MSADC/root.exe
[Tue Jan 8 21:44:58 2002] [error] [client 213.113.15.103] File does not exist: /home/www/c/winnt/system32/cmd.exe
[Tue Jan 8 21:44:58 2002] [error] [client 213.113.15.103] File does not exist: /home/www/d/winnt/system32/cmd.exe
[Tue Jan 8 21:44:59 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan 8 21:44:59 2002] [error] [client 213.113.15.103] File does not exist: /home/www/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan 8 21:44:59 2002] [error] [client 213.113.15.103] File does not exist: /home/www/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan 8 21:45:00 2002] [error] [client 213.113.15.103] File does not exist: /home/www/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe
[Tue Jan 8 21:45:00 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan 8 21:45:01 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..À¯../winnt/system32/cmd.exe
[Tue Jan 8 21:45:02 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan 8 21:45:03 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan 8 21:45:03 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%2f../winnt/system32/cmd.exe
[Tue Jan 8 22:53:09 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/root.exe
[Tue Jan 8 22:53:09 2002] [error] [client 213.113.15.103] File does not exist: /home/www/MSADC/root.exe
[Tue Jan 8 22:53:09 2002] [error] [client 213.113.15.103] File does not exist: /home/www/c/winnt/system32/cmd.exe
[Tue Jan 8 22:53:09 2002] [error] [client 213.113.15.103] File does not exist: /home/www/d/winnt/system32/cmd.exe
[Tue Jan 8 22:53:10 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan 8 22:53:10 2002] [error] [client 213.113.15.103] File does not exist: /home/www/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan 8 22:53:10 2002] [error] [client 213.113.15.103] File does not exist: /home/www/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan 8 22:53:10 2002] [error] [client 213.113.15.103] File does not exist: /home/www/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe
[Tue Jan 8 22:53:11 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan 8 22:53:11 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..À¯../winnt/system32/cmd.exe
[Tue Jan 8 22:53:11 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan 8 22:53:12 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan 8 22:53:12 2002] [error] [client 213.113.15.103] File does not exist: /home/www/scripts/..%2f../winnt/system32/cmd.exe

Är det någon som försöker att hacka min webbserver eller, är det något program som försöker göra nått..

Jag tycker det ser ut som om de e någon som försöker att hacka den ..

;)

------------------
Fragor ger svar och svar ger kunskap - hur fan fixar jag till svenska bokstaver??

RobbanMedlem sedan dec. 19992 555 inlägg

10 jan. 2002 09:34#2

Ser ut som masken Nimda (använd sökfunktionen - har skrivits om den förut i WebForum). Påverkar inte Apache eller Linux ö.h.t. mer än att man får en massa logentries. :)

------------------
Robban < robban@lipogram.com >

[Johan]Medlem sedan maj 200111 inlägg

17 jan. 2002 09:27#3

Vad den loggen visar är att någon har försökt utnyttja en bugg som finns i IIS som gör att man kan köra "DOS"-kommandon via adress-fältet, så att man kan se innehållet på hårdisken, ta bort filer med mera. Finns mycket info om den buggen på www.securityfocus.com. Kolla under "IIS executable file parsing"

/Johan