IIS

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I just started a www server using IIS 5.01 and found some strange entries on log file, could anybody explain what these are? It seems on the 1st glance that smb. wanted to access a console on the computer, and i am unaware if he succeded, is there a possibility to find out

11:40:29 - HEAD /scripts/..Ã%pc../winnt/system32/cmd.ex
11:40:30 - HEAD /winnt/system32/cmd.ex
11:40:35 - HEAD /scripts/..đ€€Ż../winnt/system32/cmd.ex
11:40:39 - HEAD /winnt/system32/cmd.ex
11:40:44 - HEAD /scripts/..%2f..%2f..%2f..%2fwinnt/system32/cmd.ex
11:40:47 - HEAD /winnt/system32/cmd.ex
11:40:49 - HEAD /scripts/..Ã%8s../winnt/system32/cmd.ex
11:41:02 - HEAD /winnt/system32/cmd.ex
11:41:35 - HEAD /scripts/..%5c../..%5c../..%5cwinnt/system32/cmd.ex
11:41:39 - HEAD /scripts/..%5c../winnt/system32/cmd.ex
11:41:40 - HEAD /winnt/system32/cmd.ex
11:41:42 - HEAD /scripts/winnt/system32/cmd.ex
11:41:45 - HEAD /winnt/system32/cmd.ex
11:41:46 - HEAD /winnt/system32/cmd.ex
11:41:48 - HEAD /scripts/winnt/system32/cmd.ex
11:41:56 - HEAD /winnt/system32/cmd.ex
11:42:21 - HEAD /winnt/system32/cmd.ex

And a 2nd one containing strange entries, anybody knows what this 'hash' is

18:49:43 - GET /.hash=4810cf41028aa6a5c61c8acbb8c5b7f404f5c5d
17:42:20 - GET /.hash=5255433cb5e132fafdcd2daf1b355ad28cdca05
15:37:13 - GET /.hash=f54637d66b30fb82fcaf6035ba8f2ab5fb1384e

Any help mostly appreciated.
 
Visit the IIS specialists in the IIS Newsgroup for expert advice:
news://msnews.microsoft.com/microsoft.public.inetserver.iis

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

------------------------------------------------------------------------------------------------------


|I just started a www server using IIS 5.01 and found some strange entries on log file, could anybody explain
what these are? It seems on the 1st glance that smb. wanted to access a console on the computer, and i am
unaware if he succeded, is there a possibility to find out?
|
| 11:40:29 - HEAD /scripts/..Ã%pc../winnt/system32/cmd.exe
| 11:40:30 - HEAD /winnt/system32/cmd.exe
| 11:40:35 - HEAD /scripts/..đ€€Ż../winnt/system32/cmd.exe
| 11:40:39 - HEAD /winnt/system32/cmd.exe
| 11:40:44 - HEAD /scripts/..%2f..%2f..%2f..%2fwinnt/system32/cmd.exe
| 11:40:47 - HEAD /winnt/system32/cmd.exe
| 11:40:49 - HEAD /scripts/..Ã%8s../winnt/system32/cmd.exe
| 11:41:02 - HEAD /winnt/system32/cmd.exe
| 11:41:35 - HEAD /scripts/..%5c../..%5c../..%5cwinnt/system32/cmd.exe
| 11:41:39 - HEAD /scripts/..%5c../winnt/system32/cmd.exe
| 11:41:40 - HEAD /winnt/system32/cmd.exe
| 11:41:42 - HEAD /scripts/winnt/system32/cmd.exe
| 11:41:45 - HEAD /winnt/system32/cmd.exe
| 11:41:46 - HEAD /winnt/system32/cmd.exe
| 11:41:48 - HEAD /scripts/winnt/system32/cmd.exe
| 11:41:56 - HEAD /winnt/system32/cmd.exe
| 11:42:21 - HEAD /winnt/system32/cmd.exe
|
| And a 2nd one containing strange entries, anybody knows what this 'hash' is?
|
| 18:49:43 - GET /.hash=4810cf41028aa6a5c61c8acbb8c5b7f404f5c5d1
| 17:42:20 - GET /.hash=5255433cb5e132fafdcd2daf1b355ad28cdca05e
| 15:37:13 - GET /.hash=f54637d66b30fb82fcaf6035ba8f2ab5fb1384ef
|
| Any help mostly appreciated.
 
Back
Top