Topic: Web server stopped

[Bobby]

Seems one of my client's has been hit by hackers or at least a milicious wannabe.

A lot of entries in the logs showing attempts to reach things like cmd.exe and root.exe.  I figure they are trying to exploit Micro$oft IIS.

Problem is that now the web server does not work.  No webmail, no web site, no http://host/server-manager (Server manager still works on port 980).  Just get "HTTP 500 - Internal server error" when trying to access anything.

Any ideas where to look to fix such an issue?

Cheers.

/B

[Terry Brummell]

What you are seeing when you see something like:

www.brummell.net 24.55.72.6 - - [10/Feb/2002:06:58:16 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-"
www.brummell.net 24.55.72.6 - - [10/Feb/2002:06:58:18 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-"
www.brummell.net 24.55.72.6 - - [10/Feb/2002:06:58:20 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-"


is actually a Nimda attack from 24.55.72.6.  It is an infected webserver that is activly scanning for other hosts to infect.  SME & Apache are not vulnerable to this exploit, I don't imagine the fact that http has stopped has anything to do with the Nimda scanning.  I get over 8000 scans a week!  

I would just reboot the server and make sure httpd restarts on reboot.  There is a command to restart httpd without rebooting, but I don't have it handy...

Terry

Bobby wrote:
>
> Seems one of my client's has been hit by hackers or at least
> a milicious wannabe.
>
> A lot of entries in the logs showing attempts to reach things
> like cmd.exe and root.exe.  I figure they are trying to
> exploit Micro$oft IIS.
>
> Problem is that now the web server does not work.  No
> webmail, no web site, no http://host/server-manager (Server
> manager still works on port 980).  Just get "HTTP 500 -
> Internal server error" when trying to access anything.
>
> Any ideas where to look to fix such an issue?
>
> Cheers.
>
> /B

[Bobby]

Have tried rebooting.

Just mentioned the attack as it is the only thing showing up weird.

Thanks for the thoughts, though.  I think there must be something simple I am missing.

/B

[Bill K]

Restart Apache with

service httpd restart

stop and start work as well as restart does.

[Bobby]

Thanks for the responses.

Turns out that it was Trend keeping it from working.  Though the server was hit with nimbda, or something like it, the server was victim to on-site staff with medling fingers.

Cheers.

/B

[Marc]

i need to run a website on iis (wdweb application) and also php for some other sites does someone how i can do that (i know it may work with port forwarding but then i'll get something like www.website.com:8080 for example to go to iis server)
Thanks for help