Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use logwatch to watch my server logs. It shows this in httpd log section:

19033 Windows executable files (502.53 MB)

This is a Debian GNU/Linux server. So it shouldn't be any Windows executables. I couldn't find any neither. Is this some kind of mixup or there is something I'm missing?

All I could find in the logs are these lines:

[Sat Dec 11 22:13:00 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/perl.exe
[Sat Dec 11 22:13:01 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/rguest.exe
[Sat Dec 11 22:13:10 2010] [error] [client 89.6.249.126] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe
[Sun May 22 02:25:16 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_mem_bin/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:16 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_mem_bin/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:17 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_vti_bin/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:18 2011] [error] [client 2.119.20.33] Invalid URI in request GET /_vti_bin/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:26 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:29 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe /c+dir?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:25:35 2011] [error] [client 2.119.20.33] Invalid URI in request GET /bin/scripts/../../../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
[Sun May 22 02:25:38 2011] [error] [client 2.119.20.33] Invalid URI in request GET /cgi-bin/../../../../winnt/system32/cmd.exe HTTP/1.0
[Sun May 22 02:25:56 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/ceilidh.exe
[Sun May 22 02:25:57 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/Cgitest.exe
[Sun May 22 02:26:02 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/cgimail.exe
[Sun May 22 02:26:09 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/cmd.exe
[Sun May 22 02:26:11 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/dbmlparser.exe
[Sun May 22 02:26:26 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpcount.exe
[Sun May 22 02:26:28 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpexplorer.exe
[Sun May 22 02:26:29 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe
[Sun May 22 02:26:30 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/get32.exe\\dir
[Sun May 22 02:26:33 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/htimage.exe
[Sun May 22 02:26:36 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/fpexplore.exe
[Sun May 22 02:26:42 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/imagemap.exe
[Sun May 22 02:26:51 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/mailform.exe
[Sun May 22 02:27:11 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/perl.exe
[Sun May 22 02:27:31 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/ppdscgi.exe
[Sun May 22 02:27:52 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/rguest.exe
[Sun May 22 02:28:26 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visadmin.exe
[Sun May 22 02:28:27 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visitor.exe
[Sun May 22 02:29:18 2011] [error] [client 2.119.20.33] File does not exist: /home/gg/www/cmd.exe
[Sun May 22 02:29:46 2011] [error] [client 2.119.20.33] script not found or unable to stat: /usr/lib/cgi-bin/visadmin.exe
[Sun May 22 02:30:12 2011] [error] [client 2.119.20.33] Invalid URI in request GET /msadc/../../../../winnt/system32/cmd.exe?/c+dir%20c:\\ HTTP/1.0
[Sun May 22 02:31:00 2011] [error] [client 2.119.20.33] Invalid URI in request GET /scripts/../../winnt/system32/cmd.exe?/c+dir HTTP/1.0
share|improve this question
add comment

1 Answer 1

Simply "someone" tried to access those files via URL. Actually, it's probably an automated script looking for usable exploits.

While those particular request are obviously targeted at Windows systems, I suggest you to install and configure apache module mod_security to catch and block those requests (and those targeted to linux system, too!).

EDIT

Actually, what's strange is that logwatch says 19033 files, which seems not to correspond on your logs.

Also, for 404/500 and similar erros should report something like:

--------------------- httpd Begin ------------------------ 

Requests with error response codes
404 Not Found
   /favicon.ico: 2 Time(s) 
500 Internal Server Error
   /: 1 Time(s)
---------------------- httpd End -------------------------

Maybe logwatch interprets as Windows executables other extension and not only .exe files.

share|improve this answer
    
Thanks. My concern is how a simple 404 can cause 502.53 MB bandwith? Or there is really some "executable" file (I couldn't cacth) served? –  Redrain Feb 24 '12 at 9:15
1  
Seems you have very frequent requests for those files. Let's say one request generate 250 bytes, you need 2M requests to have 500Mb. If you have one request every 5 second, it take only 4 mounths to reach 500Mb. –  Gregory MOUSSAT Feb 24 '12 at 9:25
    
Well, then there is a problem with logwatch. AFAIK these are daily logs. Here are last 3 days: Feb 21 - 12299 Windows executable files (339.63 MB), Feb 22 - 9247 Windows executable files (257.49 MB), Feb 23 - 20074 Windows executable files (559.11 MB) –  Redrain Feb 24 '12 at 9:45
    
That's what I thought. But couldn't be sure. There are cache files with simple html in them, with no extension. Only explanation I can think of is them. As for errors yes there are other errors. 400, 401, 403, 404, 405 and 416. But I don't think those are the reason. –  Redrain Feb 24 '12 at 10:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.