When I see this in my server stats

NickPapageorgio · 05-08-2005

"/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe " what does that mean? I find shit like that in my "Documents not found" stats. wtf is that?

Inabon · 05-08-2005

is that on a server? are you on a windows box?

Trev · 05-08-2005

It's a Code Red virus attack, are you running a windows server?

If you are there's some info and links to help here:
http://www.serverautomationtools.com/webcg...ntain-this.html

Inabon · 05-08-2005

good call trev and then you say i am a techie jajajaja.

NickPapa is that server yours (as in dedicated) or is that your customer´s server the one that we had problems getting cdonts to work.

at any rate he needs to patch it up. if you need an nt box thats secure (as secure as bill gates and his crew of numbnuts can get it cause you never know what comes up) i have one that you can host your stuff in. mine is pretty stable and it is always being checked by me and updated....

no virus attacks yet. only one hack and it was a customers fault but i fixed it

if you need someone to patch your box LMK I will need remote dektop access.

NickPapageorgio · 05-08-2005

It's on Webair's server. Are they windows servers?

NickPapageorgio · 05-08-2005

Here are all of the odd ones from this month:

/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..À¯../winnt/system32/cmd.exe
/scripts/..Áœ../winnt/system32/cmd.exe
/scripts/..%2f../winnt/system32/cmd.exe
/scripts/root.exe
/MSADC/root.exe
/c/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe
/scripts/..Á ../winnt/system32/cmd.exe
/scripts/..À/../winnt/system32/cmd.exe
/_vti_bin/owssvr.dll
/MSOffice/cltreq.asp

If it's webair's server, isn't it their responsibility to correct this if it's a problem? If not, I need help lol. What happens from this anyway? I am no techie so lamens terms would be great.

NickPapageorgio · 05-08-2005

ok so if hackers find the root.exe file they can get in my server and do some nasty shit. As long as root.exe is coming up 404 though, I should be ok right?

NickPapageorgio · 05-08-2005

hmmm...with it being a virtual account hosted by webair I don't think I have access to the actual log files to see if these returned 404 or 200. Should I contact them and let them know what's going on?

Trev · 05-08-2005

Quote:

Originally posted by NickPapageorgio@May 8 2005, 02:20 PM
hmmm...with it being a virtual account hosted by webair I don't think I have access to the actual log files to see if these returned 404 or 200. Should I contact them and let them know what's going on?

I would contact them, as it's a virtual setup it's their worry and not yours because you don't have the access to the server that they have. Plus they'll let you know if your server is windows or not.

Inabon · 05-08-2005

even if it is not windows they have a big security breach there.

and if it is windows they are sucking ass.

yes they are the ones responsible, just as we are with all virtual hosting. infact even on dedicated boxes we lend a hand if we find out it was our config problem.

commonnn webair thought you guys were better than that

Inabon · 05-08-2005

however, it may be a worm trying to get to that server but it is weird cause ussually the worms won't even try if it is not windows.

sarettah · 05-08-2005

If it was in the documents not found section of your report, then it was a 404.

I have across the years recieved many code red type attempts coming in. I don't know if code red is smart enought to know if it is a win server or not, but there are definitely things coming in like that that DO NOT realize that they are against a NIX server.

For the most part they can be ignored on a NIX box.

Since they are getting 404 on your box, then it is either a nix box or a patched Win box.

just imho of course.

NickPapageorgio · 05-08-2005

Meh...fuck tech support.

"Matt
Hello and welcome to Webair Live! What can I help you with today?
Lee Carey
Hey Matt. I don't know if this should be a concern or not but I figured I would send it in anyway. I keep getting this in my "Documents not found" stats:
Lee Carey
/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..À¯../winnt/system32/cmd.exe
/scripts/..Áœ../winnt/system32/cmd.exe
/scripts/..%2f../winnt/system32/cmd.exe
/scripts/root.exe
/MSADC/root.exe
/c/winnt/system32/cmd.exe
/d/winnt/system32/cmd.exe
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe
/scripts/..Á ../winnt/system32/cmd.exe
/scripts/..À/../winnt/system32/cmd.exe
Lee Carey
From what I understand it's the Code Red virus attack and if the root.exe comes back as 200 hackers can gain access to my server or you guys server or the box or something lol. I am no tech, so I thought I would bring it to you guys.
Matt
What machine is this Lee?
Lee Carey
It's on pornpapa.com
Matt
Lee your are on a shared unix based server.
Matt
I do not see how this has anything to do with such?
Lee Carey
No idea Matt. I just asked around on Oprano what I should do this morning if I see that in my stats because I thought it was sort of strange and they said to contact you guys and let you know it's going on.
Lee Carey
I know nothing about how any of it works at all.
Matt
It is not even in the scope of being a security concern on our end.
Lee Carey
Alright then everything is cool then?
Matt
The code red virus is a worm from 3 years ago that was exclusively limited to windows machine. I don't see how this would be relevant at all?
Lee Carey
Well Matt...I saw the stats, I thought it was strange, and since I am on a virtual account, I figured I would contact you guys just incase. I don't know how the worm works, or if it was relevant. I don't keep up with worms and server stuff."

Trev · 05-08-2005

Well at least you know you're not on a windows box

That service rep sounds fucking sucky though <_<

Inabon · 05-08-2005

Sucky customer service. what happened to service with a smile.

told you to move your stuff to me LOL

NickPapageorgio · 05-08-2005

Quote:

Originally posted by Inabon@May 8 2005, 06:24 AM
Sucky customer service. what happened to service with a smile.

told you to move your stuff to me LOL

I'm coming over soon bro.

Got alot going on right now so time constraints are fucking with me but soon.

sarettah · 05-08-2005

Hmmm...maybe it's time for all the newbies on Oprano to go in together and get a nice fast box with Inabon and share it amongst themselves...

I got off a shared server because I was tired of other people (on the server) screwing things up for me and not having any real recourse against them.

Now, if I knew everyone else that was on the box, so I could get with the person fucking up real fast, I might just drop back to a shared box just for the money savings...

just a thought, ya know.

Trev · 05-08-2005

Quote:

Originally posted by sarettah@May 8 2005, 06:11 PM
Hmmm...maybe it's time for all the newbies on Oprano to go in together and get a nice fast box with Inabon and share it amongst themselves...

I got off a shared server because I was tired of other people (on the server) screwing things up for me and not having any real recourse against them.

Now, if I knew everyone else that was on the box, so I could get with the person fucking up real fast, I might just drop back to a shared box just for the money savings...

just a thought, ya know.

I think it a damn good idea

don't let NickPapageorgio know though or you'll become his tech support

Inabon · 05-08-2005

hey i can do that. the way we config boxes are pretty stable we don´t have that many issues on our shared hosting boxes. basically the main problem with shared is when people use dbases. sucky queries and databases sometimes bog down the box but we are pretty good at finding them. and fixing

Trev · 05-08-2005

Quote:

Originally posted by Inabon@May 8 2005, 09:15 PM
hey i can do that. the way we config boxes are pretty stable we don´t have that many issues on our shared hosting boxes. basically the main problem with shared is when people use dbases. sucky queries and databases sometimes bog down the box but we are pretty good at finding them. and fixing

I so have sucky queries and databases

05-08-2005	#1
NickPapageorgio Members Join Date: Jul 2004 Posts: 843	"/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe " what does that mean? I find shit like that in my "Documents not found" stats. wtf is that? __________________ www.lotzadollars.com

05-08-2005	#3
Trev Cunty Want to see your own Advertising Here! Join Date: Jan 2003 Posts: 10,150	It's a Code Red virus attack, are you running a windows server? If you are there's some info and links to help here: http://www.serverautomationtools.com/webcg...ntain-this.html __________________ Sucks to be you.

05-08-2005	#5
NickPapageorgio Members Join Date: Jul 2004 Posts: 843	It's on Webair's server. Are they windows servers? __________________ www.lotzadollars.com

05-08-2005	#6
NickPapageorgio Members Join Date: Jul 2004 Posts: 843	Here are all of the odd ones from this month: /scripts/..%5c../winnt/system32/cmd.exe /scripts/..À¯../winnt/system32/cmd.exe /scripts/..Áœ../winnt/system32/cmd.exe /scripts/..%2f../winnt/system32/cmd.exe /scripts/root.exe /MSADC/root.exe /c/winnt/system32/cmd.exe /d/winnt/system32/cmd.exe /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe /msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/system32/cmd.exe /scripts/..Á ../winnt/system32/cmd.exe /scripts/..À/../winnt/system32/cmd.exe /_vti_bin/owssvr.dll /MSOffice/cltreq.asp If it's webair's server, isn't it their responsibility to correct this if it's a problem? If not, I need help lol. What happens from this anyway? I am no techie so lamens terms would be great. __________________ www.lotzadollars.com

05-08-2005	#7
NickPapageorgio Members Join Date: Jul 2004 Posts: 843	ok so if hackers find the root.exe file they can get in my server and do some nasty shit. As long as root.exe is coming up 404 though, I should be ok right? __________________ www.lotzadollars.com

05-08-2005	#2
Inabon One Miiiiiiiiilllllliiiiiiooooonnnnn Dollars Join Date: Jul 2004 Location: Panamá Posts: 1,585	is that on a server? are you on a windows box?

05-08-2005	#12
sarettah Stay Out Of The Box Want to see your own Advertising Here! Join Date: Oct 2002 Location: Lost in the ozone Posts: 10,318	If it was in the documents not found section of your report, then it was a 404. I have across the years recieved many code red type attempts coming in. I don't know if code red is smart enought to know if it is a win server or not, but there are definitely things coming in like that that DO NOT realize that they are against a NIX server. For the most part they can be ignored on a NIX box. Since they are getting 404 on your box, then it is either a nix box or a patched Win box. just imho of course. __________________ Free Adult Webcams