Автор: eika
Дата сообщения: 13.05.2009 23:31
Ребят, прошу помочь. Не могу понять, что за фигня. Значит, есть FTP, публично доступный через Интернет. На него ходят юзеры. Есть анонимы, а есть доверенные лица (от которых ожидать хулиганства не приходится). Всем разрешен upload. Так вот. Периодически (несколько раз в неделю или даже день) кто-то загружает в корень FTP маленькие текстовые файлы, содержащие внутри себя лишь свое собественное имя (включая расширение). Раньше такие файлы загружались только от анонимов и я списывал все на чье-то желание хакнуть FTP, но недавно такое действие было выполнено с помощью логина доверенного пользователя 'vasya'. Выглядело все это вот так:
Код: 09/05/13 09:46:38, 2536, xxx.53.28.138, , new connection from xxx.53.28.138 on xxx.xxx.xxx.xxx:21
09/05/13 09:46:38, 2536, xxx.53.28.138, , sending welcome message.
09/05/13 09:46:38, 2536, xxx.53.28.138, , 220
09/05/13 09:46:38, 2536, xxx.53.28.138, ,
09/05/13 09:46:38, 2536, xxx.53.28.138, , WELCOME!
09/05/13 09:46:38, 2536, xxx.53.28.138, ,
09/05/13 09:46:38, 2536, xxx.53.28.138, , 220
09/05/13 09:46:39, 2536, xxx.53.28.138, , USER vasya
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, 331 Password required for vasya.
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, PASS ****
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, logged in as "vasya".
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, 230 User vasya logged
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, TYPE I
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, 200 Type set to I.
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, PASV
09/05/13 09:46:39, 2536, xxx.53.28.138, vasya, 227 Entering Passive Mode (xxx,xxx,xxx,xxx,31,64)
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, STOR google9mae0xef0vi1ei.txt
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, asked to upload '/google9mae0xef0vi1ei.txt' -> '\LOCALPATH\google9mae0xef0vi1ei.txt' resuming at 0 --> Access allowed.
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, 150 Data connection accepted from xxx.53.28.138:1338; transfer starting for /google9mae0xef0vi1ei.txt
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, finished uploading '/google9mae0xef0vi1ei.txt' -> '\LOCALPATH\google9mae0xef0vi1ei.txt' from 0 to 24 (00:00:01 - 0,023 KBytes/s).
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, 226 File received ok.
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, SIZE google9mae0xef0vi1ei.txt
09/05/13 09:46:40, 2536, xxx.53.28.138, vasya, 213 24
09/05/13 09:46:41, 2536, xxx.53.28.138, vasya, DELE google9mae0xef0vi1ei.txt
09/05/13 09:46:41, 2536, xxx.53.28.138, vasya, delete file '/google9mae0xef0vi1ei.txt' -> '\LOCALPATH\google9mae0xef0vi1ei.txt' --> Access denied.
09/05/13 09:46:41, 2536, xxx.53.28.138, vasya, 550 Cannot DELE. No permission.
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, PASV
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, 227 Entering Passive Mode (xxx,xxx,xxx,xxx,31,64)
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, LIST
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, 150 Data connection accepted from xxx.53.28.138:1350; transfer starting.
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, 226 Transfer ok.
09/05/13 09:46:42, 2536, xxx.53.28.138, vasya, disconnected. (00d00:00:04)