clctech
05-07-2003, 09:27 PM
I setup a Win2K webserver. It's been up for a few months now and I went in and looked at the log files. I noticed on one day, it logged the following:
this is only a partial listing:
2003-05-05 16:12:19 24.203.65.223 - 192.xxx.xx.xx 80 GET /scripts/root.exe /c+dir 404 -
2003-05-05 16:12:20 24.203.65.223 - 192.xxx.xx.xx 80 GET /MSADC/root.exe /c+dir 403 -
2003-05-05 16:12:22 24.203.65.223 - 192.xxx.xx.xx 80 GET /c/winnt/system32/cmd.exe /c+dir 404 -
2003-05-05 16:12:23 24.203.65.223 - 192.xxx.xx.xx 80 GET /d/winnt/system32/cmd.exe /c+dir 404 -
I noticed this from 2 different source IP's. Is this an attempted hack? And from the 404 and 500's at the end of the lines, I am guessing they were denied.
Should this concern me or is this pretty routine for webserver logs?
this is only a partial listing:
2003-05-05 16:12:19 24.203.65.223 - 192.xxx.xx.xx 80 GET /scripts/root.exe /c+dir 404 -
2003-05-05 16:12:20 24.203.65.223 - 192.xxx.xx.xx 80 GET /MSADC/root.exe /c+dir 403 -
2003-05-05 16:12:22 24.203.65.223 - 192.xxx.xx.xx 80 GET /c/winnt/system32/cmd.exe /c+dir 404 -
2003-05-05 16:12:23 24.203.65.223 - 192.xxx.xx.xx 80 GET /d/winnt/system32/cmd.exe /c+dir 404 -
I noticed this from 2 different source IP's. Is this an attempted hack? And from the 404 and 500's at the end of the lines, I am guessing they were denied.
Should this concern me or is this pretty routine for webserver logs?