Strange Log in Apache

Question

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack):

\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca

full log line:

localhost:80 [REDACTED IP] - - [05/Nov/2015:11:04:05 +0100] "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " 400 226 "-" "-"

localhost:80 [REDACTED IP] - - [05/Nov/2015:07:04:14 +0100] "{\xd8\xc7/ \xef\x02\xbc9~\xdb" 400 226 "-" "-"

I already saw this kind of code in PHP code to force something like recompiled code to be executed or something like that, it stays obscure in my mind.

• What is this code (language)?
• Can I translate it ?
• Any global info that would help me to understand...

Answer 1

In that field where you see the "strange code" is where you see the HTTP request that was made to the server, for example "GET / HTTP/1.1".

That log line means that someone connected to your server and send that "strange code" instead of a normal HTTP request, it could be a exploit for your current server or trying to exploit the shellshock bug.

A good thing to do now is try to check if there are some known bugs for your current Apache version, and test your system agains shellshock exploit.

• How to reproduce it: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " | nc -n -i 1 www.website.com 80

• How to get the converted code: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f "