Acceso al cmd.exe mediante vulnerabilidad LFI | Operating systems, scripting, PowerShell and security

Logs, Seguridad, Servidores

Se intenta en diferentes subcarpetas:

/scripts/..??../winnt/system32/cmd.exe
/msadc/..??../..??../..??../winnt/system32/cmd.exe
/_vti_bin/..??../..??../..??../winnt/system32/cmd.exe

/scripts/..??../winnt/system32/cmd.exe

/msadc/..??../..??../..??../winnt/system32/cmd.exe

/_vti_bin/..??../..??../..??../winnt/system32/cmd.exe

Detectado en la consulta:

SELECT     [cs-uri-stem], COUNT(*) AS EXPR1
FROM         tabla
where  [cs-uri-stem] like '%?%'
GROUP BY [cs-uri-stem]
ORDER BY 2 desc

SELECT [cs-uri-stem], COUNT(*) AS EXPR1

FROM tabla

where [cs-uri-stem] like '%?%'

GROUP BY [cs-uri-stem]

ORDER BY 2 desc

Bloquear el ataque utilizando la IP de origen o la cadena de entrada ‘..??..’.

Acceso al cmd.exe mediante vulnerabilidad LFI (Servidores, Seguridad, Logs)