Apache Logs: am i being hacked?

[Tea_J]

Hi guys.. i got some weird log entries on my apache server...

for one:

210.213.72.84 - - [05/May/2005:21:31:05 +0800] "SEARCH /\x90\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9\xc9.........

The above goes on for hundreds of lines and even thousands.. what does this mean?

Could it be a DOWNLOAD request? since im hosting a couple of 300MB rar files on here..

other weird lines:

210.213.72.84 - - [05/May/2005:21:31:33 +0800] "POST /vti_bin/vti_aut/fp30reg.dll HTTP/1.1" 404 295
216.243.111.27 - - [06/May/2005:03:39:05 +0800] "get /vti_pvt/root.exe?/c+dir" 501 -
203.200.28.144 - - [06/May/2005:08:59:45 +0800] "get /vti_pvt/root.exe?/c+dir" 501 -
62.177.215.22 - - [06/May/2005:10:53:29 +0800] "get /vti_pvt/root.exe?/c+dir" 501 -
220.144.155.252 - - [06/May/2005:11:33:32 +0800] "get /vti_pvt/root.exe?/c+dir" 501 -

root.exe? c+dir? these erally look mischievous.. is someone trying to get to me? looks to me like someone's trying to gain access to C: ... is this possible even?

tea

[Weedpacket]

Since you're not running IIS the worst these attacks can is hog your bandwidth with useless requests. The long one looks like a Code Red - an attempt to exploit a three-year-old buffer-overrun bug in that server's indexing service. (So somewhere out there is an IIS server that hasn't been upgraded after at least three years of exposed vulnerabilities. Don't ya just love some people?). The others also target known IIS vulnerabilities.

[Tea_J]

I see..

so is there by anychance someone I know and knows my server's IP address is doing this?

Or is this a random mass attack thing being sent out to thousands of IPs? Coz of all people, how could they know about my webserver? This is just a small and private server.. just for testing.. only 3 people know about this..

IIS sucks big time.. but my APACHE is running on WINDOWS.. it's still apache.. but do I have any IIS vulnerabilities too?

Tea

[dalecosp]

Concur. The shorter one is also an old IIS exploit, IIRC. Certainly no danger to apache; unless you've installed FrontPage extensions, most of those URI's will be very invalid anyways....

[dalecosp]

Originally posted by Tea_J
I see..

so is there by anychance someone I know and knows my server's IP address is doing this?

Or is this a random mass attack thing being sent out to thousands of IPs? Coz of all people, how could they know about my webserver? This is just a small and private server.. just for testing.. only 3 people know about this..

IIS sucks big time.. but my APACHE is running on WINDOWS.. it's still apache.. but do I have any IIS vulnerabilities too?


Tea

Random, mass (?) ... the Nimda/Code Red worm, as Weed mentioned. Dunno how "mass" it is any longer. Probably some dude from Arkansas 😃

[dalecosp]

Originally posted by Tea_J
This is just a small and private server.. just for testing.. only 3 people know about this..

No, anyone who can manage so simple a thing as a ping scan of your network knows that port 80 is either open, filtered, or closed...

IIS sucks big time.. but my APACHE is running on WINDOWS.. it's still apache.. but do I have any IIS vulnerabilities too?

Tea

Windows Update .... better yet, try Linux or BSD 😃

[Tea_J]

@
dalecosp

lolz

sorry if i wasnt clear. i was in a hurry a while ago..

No, anyone who can manage so simple a thing as a ping scan of your network knows that port 80 is either open, filtered, or closed...

yes but what i wanted to know is did that "anyone" direct it to me or was that a random thing he did that COINCIDENTLY caught my IP?

I would change the port for my webserver but i need it to stay generic for me friends.

Windows Update .... better yet, try Linux or BSD

my real server is on *nix.. hosted in US.. this is my personal box.. strictly for development purposes.. 🙂

[Weedpacket]

Originally posted by Tea_J
yes but what i wanted to know is did that "anyone" direct it to me or was that a random thing he did that COINCIDENTLY caught my IP?

for($a=0; $a<256; $a++)
for($b=0; $b<256; $b++)
for($c=0; $c<256; $c++)
for($d=0; $d<256; $d++)
{
    $ip = "$a.$b.$c.$d";
    $handle = fsockopen($ip, 80, $e, $s, 10);
    if($handle)
    {
        $out = "SEARCH / \\x90".str_repeat("\\xc9", 10000)." HTTP/1.1\r\n";
        $out .= "Host: $ip\r\n";
        $out .= "Connection: Close\r\n\r\n";
        fwrite($handle, $out);
    // ...etc. etc.
    }
}

There are machines to do these things.

[dalecosp]

Originally posted by Weedpacket
There are machines to do these things.

... and most of 'em are PC's that haven't been to Windows Update in months ... have no password on the "Administrator" account, have no spy-ware checking software, etc., etc.

As Weedpacket noted, the one that's making entries in your logs, Tea_J, is suffering from a virus that's probably at least 3 years old....

Dear me, Mr. Weedpacket, I believe you could write malware in your spare time :eek:

😃

[piersk]

Originally posted by dalecosp
Dear me, Mr. Weedpacket, I believe you could write malware in your spare time :eek:

Who says he doesn't :evilgrin:

[dalecosp]

Well, so far neither the FBI/NSA/CIA, nor MI$n, nor Mossad, nor KGB (whatever it's called now) has said that he does...

[piersk]

Originally posted by dalecosp
MI$n

Whats that?

[dalecosp]

Well, isn't one of the Brit Secret Services MI-some number or another? MI6, generally; some movie I saw the other day used MI5 and I think I've seen MI7 as well; but of course, one can't base one's understanding of facts on Hollywood...

Ah, yes ... a little googling to clarify my Uncle Sam ignorance ... so $n must needs to equal to either 5 or 6, and as Weed's a Kiwi, I guess it'd be 6 ... if so trivial a thing as writing malware could attract the attention of Mr. Bond's superiors ....

😃

[piersk]

Ahh, I understand now.

For the record, only MI5 and MI6 are still around (or at least thats as far as I know... ¬_¬)

MI5 looks after secret stuff in the UK and MI6 is for abroad

[dalecosp]

Hmm, so if, and that's a big conspiratorial IF an MI7 exists, it must be "Her Majesty's Secret Space Service", eh?

We'd actually like to thank you Brits for many things, including (at the very least), Jackie Bisset, Emma Samms, the Merseybeat, and a great language...

Cheerio! 🙂

[Tea_J]

We'd actually like to thank you Brits for many things, including (at the very least), Jackie Bisset, Emma Samms, the Merseybeat, and a great language...

dont forget katie price ... :evilgrin:

[Weedpacket]

Originally posted by dalecosp
Hmm, so if, and that's a big conspiratorial IF an MI7 exists, it must be "Her Majesty's Secret Space Service", eh?

Well, there is a gap between MI6 and MI8 (which last is part of GCHQ, now)....

Oh, and thanks for Joanna Lumley.