suspicious logs

is this an exploit?!?

[tito]

hello,
i've found the following on my server logs:

www.domain1.com 195.****.xxx.xx - - [26/Jan/2004:17:32:42 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 302 - "-" "-"
www.domain2.com 195.xxx.xxx.xx - - [26/Jan/2004:17:32:42 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 302 - "-" "-"
ns1.domain.com 195.xxx.xxx.xx - - [26/Jan/2004:17:32:42 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 302 - "-" "-"
www.domain3.com 195.xxx.xxx.xx - - [26/Jan/2004:17:32:42 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 302 - "-" "-"

i'm afraid this could be an exploit, however i'm running Apache on SunCobalt and the requests seem to look for windows sys files, the response code is 302 = found.

please i'd like to know your opinions, do i have to worry? what i should do? write to their ISP for abuse?!?

Thanks in advance for your help
tito

[iTISTIC]

These are just script kiddies trying to exploit an old vulnerability in IIS. They obviously haven't even checked to see that your server is not running a Microsoft platform. It is safe to ignore these errors, but I would still recommend keeping an eye on your logs as somebody COULD be trying to compromise your server. Chances are, though, that this person is just playing with his new little script.

As far as the 302 response code goes, this is the temporary redirect code (meaning the page has been temporarily moved to a new URL). Your server is probably sending a redirect to a page that you have setup for 404 errors.

Shawn
iTISTIC.com

[tito]

Tnaks Shawn

ok, i will not inform their ISP (a greek university and a nyc institute of tech.)
strange that both requests come almost at the same time (20 min. difference about on the same day originating from 2 different ISP) am i under a cross fire?!?
i thought to ban those IPs on my server but i guess it's a waste of time, isn't it?!?

Thanks a lot for your helpful reply
tito

[PatrickDeese]

A lot of times, the infected servers are set up to look for other infected servers - it is probably just easier to check by sequential ip address than to actually make a database file of sites running the target OS and then seeing if they are vulnerable.

[tito]

I see PatrickDeese, so nothing to worry about?!? these things happens?!?
I've just started my own server managing, so many things to learn each day..