[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] Weird Access Log entries

i think this one should help:

http://list.cobalt.com/pipermail/cobalt-security/2002-December/006879.html



greetz
mf




On Tue, 2003-10-14 at 14:53, John D Gorena wrote:
> I am getting a few of these in my access logs in one of my Raq550s.  Does anyone
> know what this means?
> 
> ns1.jmgenterprises.com 12.248.198.33 - - [14/Oct/2003:03:19:15 -0500] "GET
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302 241 "-" "-"
> ns1.jmgenterprises.com 12.248.198.33 - - [14/Oct/2003:03:19:15 -0500] "GET
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302 241 "-" "-"
> ns1.jmgenterprises.com 12.248.198.33 - - [14/Oct/2003:03:19:16 -0500] "GET
> /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302 258 "-" "-"
> 
> John
> 
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users