2

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack):

\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca

full log line:

localhost:80 [REDACTED IP] - - [05/Nov/2015:11:04:05 +0100] "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " 400 226 "-" "-"

localhost:80 [REDACTED IP] - - [05/Nov/2015:07:04:14 +0100] "{\xd8\xc7/ \xef\x02\xbc9~\xdb" 400 226 "-" "-"

I already saw this kind of code in PHP code to force something like recompiled code to be executed or something like that, it stays obscure in my mind.

  • What is this code (language)?
  • Can I translate it ?
  • Any global info that would help me to understand...
1

In that field where you see the "strange code" is where you see the HTTP request that was made to the server, for example "GET / HTTP/1.1".

That log line means that someone connected to your server and send that "strange code" instead of a normal HTTP request, it could be a exploit for your current server or trying to exploit the shellshock bug.

A good thing to do now is try to check if there are some known bugs for your current Apache version, and test your system agains shellshock exploit.

  • How to reproduce it: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " | nc -n -i 1 www.website.com 80

  • How to get the converted code: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f "

  • thanks but in fact i am lore looking on how to reproduce it, and be able to get the converted code to know what was tried. About my apache security all is ok. – Froggiz Nov 6 '15 at 8:00
  • I just edited the reply with the answer to your comments – unknown Nov 9 '15 at 2:04
  • thanks, there is something strange ` won't pass on the printf – Froggiz Nov 9 '15 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.