Strange items in Apache log, please help?

Discussion in 'Apache' started by Malteserr, Aug 6, 2010.

0
  1. #1
    Hey guys,

    I started learning about how to host my own web server around 3 months ago, so I'm still (VERY) new to this, but that's not to say I haven't learnt much since I started.

    One thing that still baffles (and worries) me though is a recurring item in my Apache access log.

    88.185.8.194 - - [06/Aug/2010:07:50:31 +0200] "5T[\x8cf\xb3\xdc!\x1c\xfa\xaa\xe0\x07{\xa4=_y\xf5\xfd\x95\x04\x02" 200 14967 "-" "-"
    62.209.130.42 - - [06/Aug/2010:19:20:24 +0200] "h\xac\x10,s\xe5\xe4k\x036\x9a\xaa\x11l)KG\x93" 200 21041 "-" "-"

    Now, I did my best to research what these things are before posting this thread, and from what I understand, it's shell code? or some code injection of sorts? (I run the server on windows, haven't had time to test linux out)
    What worries me most is the fact that http 200s are being returned, which means something is obviously happening, and they're not being outright rejected (403, 404, 405 or one of the other 4xx codes)

    Can anyone please help me understand what the hell's going on? And what I can perhaps do to remedy it? (I installed mod_security and configured some rules yesterday which helped stop some of the other potential attacks... except these two)

    One final note: My server hosts a phpbb3 forum and nothing else, if these attacks are in fact targeting the website not the server/software.

    Regards,
    Malt
     
    Malteserr, Aug 6, 2010 IP
  2. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #2
    It's most likely a kiddie script trying to find security holes in your server.
     
    digitalpoint, Aug 6, 2010 IP
  3. Malteserr

    Malteserr Peon

    Messages:
    3
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Thanks for the reply digital :)

    Yep, that's what I thought too, and after spending an afternoon reading about this (4 hours of small text on a screen about a problem you never heard of = major headache) it seems to be the case.

    I just hope he didn't find any lol, but the http 200 codes being returned are worrysome.
     
    Malteserr, Aug 6, 2010 IP
  4. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #4
    Well you could always try the URL in your logs yourself and see if the page looks odd at all.
     
    digitalpoint, Aug 6, 2010 IP
  5. Malteserr

    Malteserr Peon

    Messages:
    3
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    That's the thing, they're not URLs :/ I tried putting them after my site's name and I get a 404 .. but someone is clearly succeeding using something else

    Oh well, I'll try to ignore this issue. But if anyone on this forum has an idea what might be happening, please let me know ;)
     
    Malteserr, Aug 6, 2010 IP
  6. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,334
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #6
    Just realized it's not an actual GET request... looks like it's looking for some sort of bug in your actual web server, and not the files/code it's serving. Best thing to do is make sure your web server has any security patches for it and it's up to date.
     
    digitalpoint, Aug 6, 2010 IP