Unusual Activity

["Graydon McKee" <graydon.s.mckee.iv () orcmacro com>]

Hello All, 
            I'm seeing some unusual activity.  One of our web servers it sending emails via a
feedback page that proport to come from 333-333-3333test () test999 com.  These messages have various
things in the From Field: 
 
From: "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini" <> 
From: "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd" <> 
From: "\\\\'/bin/cat /etc/passwd\\\\'" <>
 
88 of these messages were generated in under a minute so I'm pretty sure that someone is running a
script against this page but I am having problems finding out exactly what is being run and what
exploit is being looked for.  Something tells me that this should be pretty simple but for some
reason I can't put my finger on it.  Does anyone have any ideas or suggestions that would help me
out here?  
 
Thanks
 
Graydon S McKee IV - GSEC
Firewall/Security Administrator
ORC Macro - Macro International
11785 Beltsville Drive
Calverton, Maryland 20705
301-572-0583 Fax: 301-572-0982

Attachment: Graydon McKee.vcf
Description:

Attachment: smime.p7s
Description: