Need help on the IIS log

[biddingbong]

I usually check the log and most of the time there's nothing wrong. But I saw this some days back, can someone give me a little explanation on this:

07:57:27 xx.xxx.xxx.xxx GET /scripts/..%5c%5c../winnt/system32/cmd.exe 500

(I've removed the original IP replacing it by xx)

Thanks.

 

[ChrisHirst]

crack attack/script kiddie hack. so long at it returns 500 you should be ok



Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[biddingbong]

Is there a way to permanently block this IP from IIS (WinXP)?

 

[ChrisHirst]

you can on the directory security tab. But its hardly worth it 'cos it'll be coming from a different IP in a couple of hours.



Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[biddingbong]

Maybe the IP differs each time, but its always from the same country.

 

[ChrisHirst]

probably the same person!

Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.

 

[biddingbong]

What's the remedy?

 

[ChrisHirst]

make sure your security is up to it.

it's what we face 24/7 when running webservers.

Chris.

Indifference will be the downfall of mankind, but who cares?

http://www.candsdesign.co.uk

A website that proves the cobblers kids adage.

http://www.cram-system.com

Nightclub counting systems

So long, and thanks for all the fish.