Hey all! I'm just throwing this out here to get some feedback. This is not an urgent post. Okay so everybody is who running Apache has surely seen entries in the Apache Access log file that look like this:

stupid.iis.com - - [25/Jan/2003:10:41:28 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1266 "-" "-"

I'm so sick of seeing these entries in my log files. It just furthers my hatred towards the "Evil Empire". Could we possibly have a script that identifies these requests and denies these servers further access?

The majority of these requests start like this:
"GET /scripts...."
"GET /c/winnt..."
"GET /d/winnt..."
"GET some other exploits"

Okay maybe totally blocking out these servers is a little dramatic but I'm just sick and tired of seeing these lines in my log files.

Does anyone else feel my pain?

Blocking this on the logging would require modification of the log module ... don't know of any other way to block those things ... you could write a script which checks your apache log files and eliminates all entries that are not required to be checked ... and save the new file as log_to_check.access or whatever

I believe the purpose of the log is to identify all incoming traffic. This is just a script kiddie's program trying to do stuff. At the most it'll add a few kilobytes to the log after you've archived them, but I'd just let the kid knock and ignore it.

Here is an evil thought that won't help but might make you feel better...

Make a readable folder called c/winnt somewhere on your web server and start a collection of windows virii there.

What does the virus do? It looks like its trying to "GET" this folder. What if I put some .exe file in there. Would it download the file? Oh boy people could have fun with this.

It's trying to gain System access to a Windows machine via vulnerable IIS webserver. Try searching Google for Code Red, Nimda, and SirCam.