2

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack):

\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca

full log line:

localhost:80 [REDACTED IP] - - [05/Nov/2015:11:04:05 +0100] "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " 400 226 "-" "-"

localhost:80 [REDACTED IP] - - [05/Nov/2015:07:04:14 +0100] "{\xd8\xc7/ \xef\x02\xbc9~\xdb" 400 226 "-" "-"

I already saw this kind of code in PHP code to force something like recompiled code to be executed or something like that, it stays obscure in my mind.

  • What is this code (language)?
  • Can I translate it ?
  • Any global info that would help me to understand...
1

1 Answer 1

1

In that field where you see the "strange code" is where you see the HTTP request that was made to the server, for example "GET / HTTP/1.1".

That log line means that someone connected to your server and send that "strange code" instead of a normal HTTP request, it could be a exploit for your current server or trying to exploit the shellshock bug.

A good thing to do now is try to check if there are some known bugs for your current Apache version, and test your system agains shellshock exploit.

  • How to reproduce it: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f " | nc -n -i 1 www.website.com 80

  • How to get the converted code: printf "\x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~L\x88\x19\xca \xbfs\x7f "

3
  • thanks but in fact i am lore looking on how to reproduce it, and be able to get the converted code to know what was tried. About my apache security all is ok.
    – Froggiz
    Nov 6, 2015 at 8:00
  • I just edited the reply with the answer to your comments
    – unknown
    Nov 9, 2015 at 2:04
  • thanks, there is something strange ` won't pass on the printf
    – Froggiz
    Nov 9, 2015 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .