Solved

what does this IIS log tell me...

Posted on 2001-06-06
4
1,658 Views
Last Modified: 2008-02-07
The following entries are found in my IIS log file. Please tell me what does it mean. (NT4 + IIS4) Thanks,

2001-05-19 08:27:14 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/../../winnt/system32/cmd.exe /c+dir 404 3 604 85 150 80 HTTP/1.0 - - -
2001-05-19 08:27:14 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..\../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:15 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..\../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:15 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/../../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:16 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/../../winnt/system32/cmd.exe /c+dir 404 3 604 85 150 80 HTTP/1.0 - - -
2001-05-19 08:27:16 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..\../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:18 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..A../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:18 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..\../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:19 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..o../winnt/system32/cmd.exe /c+dir 404 3 604 85 160 80 HTTP/1.0 - - -
2001-05-19 08:27:19 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/../../winnt/system32/cmd.exe /c+dir 404 3 604 88 140 80 HTTP/1.0 - - -
2001-05-19 08:27:21 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..????../winnt/system32/cmd.exe /c+dir 404 3 604 91 160 80 HTTP/1.0 - - -
2001-05-19 08:27:21 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..?????../winnt/system32/cmd.exe /c+dir 404 3 604 94 170 80 HTTP/1.0 - - -
2001-05-19 08:27:22 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /scripts/..u?????../winnt/system32/cmd.exe /c+dir 404 3 604 97 140 80 HTTP/1.0 - - -
2001-05-19 08:27:22 202.64.252.67 - W3SVC3 SDC1M004 10.2.2.254 GET /msadc/../../../../../../winnt/system32/cmd.exe /c+dir 404 3 604 114 160 80 HTTP/1.0 - - -
0
Comment
Question by:jians
  • 2
  • 2
4 Comments
 
LVL 5

Accepted Solution

by:
dredge earned 5 total points
ID: 6160688
that means that someone was trying to exploit the UNICODE bug in IIS4.

this was a but that allowed a user to execute command shells through a web page by breaking out of your directory structure by using a unicode error in IIS.

you should install NT Service Pack 6a to fix this problem.
0
 

Author Comment

by:jians
ID: 6161012
Could you point me a link with more details? Thanks!
0
 
LVL 5

Expert Comment

by:dredge
ID: 6161079
http://www.microsoft.com/technet/iis/

I can't seem to find the specific Unicode bug anymore, but it used to be listed on the front page.

Service Pack 6a fixes this problem, though.
0
 

Author Comment

by:jians
ID: 6161249
Thanks a lot!
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Logparser is the smartest tool I have ever used in parsing IIS log files and there are many interesting things I wanted to share with everyone one of the  real-world  scenario from my current project. Let's get started with  scenario - How do w…
Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question