2

I use logwatch to watch my server logs. It shows this in httpd log section:

19033 Windows executable files (502.53 MB)

This is a Debian GNU/Linux server. So it shouldn't be any Windows executables. I couldn't find any neither. Is this some kind of mixup or there is something I'm missing?

All I could find in the logs are these lines:

[Sat Dec 11 22:13:00 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/perl.exe
[Sat Dec 11 22:13:01 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/rguest.exe
[Sat Dec 11 22:13:10 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe
[Sun May 22 02:25:16 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_mem_bin/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:16 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_mem_bin/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:17 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_vti_bin/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:18 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_vti_bin/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:26 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:29 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe /c+dir?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:35 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:38 2011] [error] [client 2.119.20.33] Invalid URI in request GET /cgi-bin/../../../../winnt/system32/cmd.exe HTTP/1.0
[Sun May 22 02:25:56 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/ceilidh.exe
[Sun May 22 02:25:57 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/Cgitest.exe
[Sun May 22 02:26:02 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/cgimail.exe
[Sun May 22 02:26:09 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/cmd.exe
[Sun May 22 02:26:11 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/dbmlparser.exe
[Sun May 22 02:26:26 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpcount.exe
[Sun May 22 02:26:28 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpexplorer.exe
[Sun May 22 02:26:29 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe
[Sun May 22 02:26:30 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe\\dir
[Sun May 22 02:26:33 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/htimage.exe
[Sun May 22 02:26:36 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpexplore.exe
[Sun May 22 02:26:42 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/imagemap.exe
[Sun May 22 02:26:51 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/mailform.exe
[Sun May 22 02:27:11 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/perl.exe
[Sun May 22 02:27:31 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/ppdscgi.exe
[Sun May 22 02:27:52 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/rguest.exe
[Sun May 22 02:28:26 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visadmin.exe
[Sun May 22 02:28:27 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visitor.exe
[Sun May 22 02:29:18 2011] [error] [client 2.119.20.33] File does not exist: /home/gg/www/cmd.exe
[Sun May 22 02:29:46 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visadmin.exe
[Sun May 22 02:30:12 2011] [error] [client 2.119.20.33] Invalid URI in request GET /msadc/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:31:00 2011] [error] [client 2.119.20.33] Invalid URI in request GET /scripts/../../winnt/system32/cmd.exe?/c+dir HTTP/1.0

1 Answer 1

4

Simply "someone" tried to access those files via URL. Actually, it's probably an automated script looking for usable exploits.

While those particular request are obviously targeted at Windows systems, I suggest you to install and configure apache module mod_security to catch and block those requests (and those targeted to linux system, too!).

EDIT

Actually, what's strange is that logwatch says 19033 files, which seems not to correspond on your logs.

Also, for 404/500 and similar erros should report something like:

--------------------- httpd Begin ------------------------ 

Requests with error response codes
404 Not Found
   /favicon.ico: 2 Time(s) 
500 Internal Server Error
   /: 1 Time(s)
---------------------- httpd End -------------------------

Maybe logwatch interprets as Windows executables other extension and not only .exe files.

4
  • Thanks. My concern is how a simple 404 can cause 502.53 MB bandwith? Or there is really some "executable" file (I couldn't cacth) served?
    – Redrain
    Feb 24, 2012 at 9:15
  • 1
    Seems you have very frequent requests for those files. Let's say one request generate 250 bytes, you need 2M requests to have 500Mb. If you have one request every 5 second, it take only 4 mounths to reach 500Mb. Feb 24, 2012 at 9:25
  • Well, then there is a problem with logwatch. AFAIK these are daily logs. Here are last 3 days: Feb 21 - 12299 Windows executable files (339.63 MB), Feb 22 - 9247 Windows executable files (257.49 MB), Feb 23 - 20074 Windows executable files (559.11 MB)
    – Redrain
    Feb 24, 2012 at 9:45
  • That's what I thought. But couldn't be sure. There are cache files with simple html in them, with no extension. Only explanation I can think of is them. As for errors yes there are other errors. 400, 401, 403, 404, 405 and 416. But I don't think those are the reason.
    – Redrain
    Feb 24, 2012 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .