Is the following a hack attempt?

Client Joined: Jul 18, 2003 Posts: 977

Why would someone try to see these files?

Code:

File does not exist: /home/*******/public_html/MSOffice/cltreq.asp


File does not exist: /home/*******/public_html/_vti_bin/owssvr.dll

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Yep. But only a problem if you use a winblows server ROTFL

Posted: Fri Dec 02, 2005 9:38 am

Thanks Raven. Sentinel did not stop this. Another thing these came from an IP at Ft Campbell. Right on the base!!

Posted: Fri Dec 02, 2005 9:54 am

NukeSentinel is not supposed to stop that. NukeSentinel guards against XSS and SQL injections. Not winblows exploits.

Posted: Fri Dec 02, 2005 10:32 am

Thank you kind sir!

Posted: Fri Dec 02, 2005 4:17 pm

blith
Be happy if you have only these two 404 files because there are a lot more. I found in my logfile analyzer e.g.:

/MSOffice/cltreq.asp
/_vti_inf.html
/_vti_bin/shtml.exe/_vti_rpc
/_vti_bin/_vti_aut/author.exe
/_vti_bin/_vti_aut/author.dll

But there are many results in "google" about this. See also: [ Only registered users can see links on this board! Get registered or login! ]

Posted: Fri Dec 02, 2005 4:30 pm

Susann wrote:

blith
Be happy if you have only these two 404 files because there are a lot more. I found in my logfile analyzer e.g.:

/MSOffice/cltreq.asp
/_vti_inf.html
/_vti_bin/shtml.exe/_vti_rpc
/_vti_bin/_vti_aut/author.exe
/_vti_bin/_vti_aut/author.dll

But there are many results in "google" about this. See also: [ Only registered users can see links on this board! Get registered or login! ]

Oh so this is not a bad thing... okay cool

Quote:

Friendly. You're being visited by a user who has installed Microsoft Office and Internet Explorer, and who has enabled the "Discuss" toolbar in his browser. When that toolbar is enabled, the browser will automatically query for these two files when visiting each site, to determine whether the Office Server Extensions are installed.

Posted: Fri Dec 02, 2005 4:34 pm

Yes its not bad like others e.g. /ultramode.txt/xmlrpc.php

xmlrpc.php found this also in my analyzer. It´s no security risk for php-nuke and wordpress if I remember correctly but for some other cms.

I find the 404 files always interesting.