Someone in Hungary tried something odd recently:


This is the partial URL from my log, showing the page they went to. They gave my site's URL as the referrer.

What, if anything, would this kind of access do to a vulnerable server?

Thanks for any info. 


3 Answers 3


As @HendrikBrummermann already pointed out in the comments, it was an attempt to exploit register_globals on a PHP enabled web server.

The server making the request that ended up in your web server's logs, so it turned out, was merely an infected web server running in zombie mode, running a stealth bot checking for possible attack vectors on unsuspecting web servers throughout Internet on behalf of larger botnet, controlled through a LeaseWeb B.V., Netherlands hosted command and control server with an IP of hosting hundreds of suspicious domains. According to Spamhaus CBL, the server with an IP located in Budapest, Hungary was infected with Hermes trojan:

Hermes is a banking trojan aimed to steal credentials for online banking accounts. It spreads through hijacked websites (drive-by exploits) and malicious email attachments.

I've been analyzing this botnet's command and control IP a bit, and it is running a VNC Remote Desktop on port 5900, meaning it's also controlled from a remote location that is unknown to us. But that's beyond the point, as it's quite normal for such criminal networks to simply switch to another hosting company, if and when the one they rely on now is required by law to take action. As hosting companies don't particularly like to take action until they absolutely have to, this might not be on the top of their to-do list. What will more likely happen is that the botnet's current IP will be marked as blacklisted in too many RBLs to feel comfortable operating from (live status), and move its command and control to another hosting company.

So, in short, the suspicious line in your web server's logs was just one of the attack vectors that such botnets would be scanning for, looking for ways to exploit web servers. If the takeover was successful, the next person that opened your web page would've been redirected to the exploited zombie server in Budapest, Hungary and the botnet would've known your web server was thus exploitable by checking the referral string. However, your web server was obviously not the low hanging fruit they were hoping to exploit this easily, at least not through this particular PHP security hole. Botnet cares not and has moved on to scanning thousands of other hosts by the time you finished reading my last sentence.

Just another day on the WWW. ;)


According to URL he things you are running PHP site (_SERVER variable). The only effect is that you will have defined _SERVER[DOCUMENT_ROOT] INSIDE _GET variable.

    [_GET] => Array
            [_SERVER] => Array
                    [DOCUMENT_ROOT] =>

  • 1
    OK, but the variable name is not being itself evaluated by PHP as far as I know.
    – Funnelcake
    Apr 6, 2013 at 13:44
  • 1
    Yes sure, but as sharp12345 mentioned it also depends on the code, I saw many times that some one processed _GET or _POST regardless of whether they contain only correct data. And I only show what effect it will have, I didn't mention that it will run something :)
    – pin007
    Apr 7, 2013 at 5:38

Actually the readme.txt from this server is google advertising ;-)

But if the register globals exploit would have been working, your website redirects to this readme.

  • That's just an initial landing page that serves as a detection mechanism for successfully exploited servers, and I highly doubt it's where attacks are controlled from. It's more probable that's just another exploited web server infected with an automated crawler (botnet), checking random web server IPs for ways of exploiting them. If some web server is so easily exploitable, then later changing that value to any other is equally as easy. This Spamhaus CBL confirms my suspicions. It was updated today from unknown to Hermes trojan.
    – TildalWave
    Apr 7, 2013 at 1:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .