Hack Attempt?

[sbessel]

Is this a hack attempt from someone on the 'outside' ? I tried to lookup the IP address but nothing came back. This is the first and only time I have seen this.
<pre class="ip-ubbcode-code-pre">
5/2/2004 9:25:05 AM~!~Info~!~ Got data but was not PUT or GET, from: 202.99.244.36 Data: get /scripts/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c 0%af/winnt/system32/cmd.exe?/c%20dir

</pre>

[htsource]

It looks like one of the web server virus trying to get to your site to run some command lines. However, it doesn't seem to be successful.

Are you running your HS web on port 80? I used to get those a lot. I don't think it's anyone trying to hack to your site, it's probably someone else got hit with the virus and scanning computers for more infection.

Simon

[jon00]

I must say, it does look suspicious. They are trying to get something to execute through the command prompt. Probably a virus probing you.

FYI the IP is registered to the CNCGroup CHINA

[rocco]

It's the "Directory Traversal Exploit".

IIS had a bug that allowed a URL to "break-out" of your published web directory structure and navigate to the root directory of the IIS computer. The repeated "..%c0%af" portion would progressively work back to the root directory from your /scripts/ directory, where the "/winnt/system32/cmd.exe?/c%20dir" portion would execute a "dir" command. If your system responded to the 'dir', the probe would know that it found a vulnerable machine, and would follow-up with additional lines that would copy the worm into your machine and execute it.

I get about a dozen of these a week. You only need to worry if you are running IIS.

[sbessel]

.. that is what I figured. Too bad I couldn't feed them back a nice destructive virus.

I wasn't really worried as my firewall protects me pretty good...

[Rupp]

Rocco,
What if we are running IIS?

[huggy591]

You only need to worry if you are running an UNPATCHED IIS without URLSCAN.

[Rupp]

Gordon,
Concerning the IIS lockdown tool, can this be run on XP? The link I found points to Windows 2000 server.

[Warcorp]

Yes, just seperate out the URLScan from the Lockdown tool and run it seperately. Unpack the lockdown tool to a directory (technet has instructions on how to do it) and run urlscan.