Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <e290115fea0c49bdc5cd167da8a7bc3b@rbnsn.com>
References: <dac82969-3312-49b8-8e6c-f49c966b1d5b@default> <1789242276.27250137.1486400880413.JavaMail.zimbra@helmholtz-muenchen.de>
 <e290115fea0c49bdc5cd167da8a7bc3b@rbnsn.com>
From: Mitchell Krog <mitchellkrog@gmail.com>
Date: Mon, 6 Feb 2017 19:30:48 +0200
Message-ID: <CAM6zd421R=9-em0cQEjtyM-9z3J227h__rMxsg2d-LH0vvzKEQ@mail.gmail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=94eb2c196fd412a82d0547dffeca
Subject: Re: [users@httpd] am i hacked ?
archived-at: Mon, 06 Feb 2017 17:30:55 -0000

--94eb2c196fd412a82d0547dffeca
Content-Type: text/plain; charset=UTF-8

I see these type of attack strings all the time on Nginx except Nginx gives
a 403. Apache is notoriously bad with security and giving 200 ok responses
makes you **** yourself. A reason  I and many other people have switched.
User support on this list was also non existent when I ran into serious SSL
problems with 2.4 that until today have been ignored and unanswered.

On 06 Feb 2017 19:21, "Ken Robinson" <kenrbnsn@rbnsn.com> wrote:

>
>
> On 2017-02-06 12:08 pm, Lentes, Bernd wrote:
>
> The first line is trying to create the file webconfig.txt.php in your
>>> DOCUMENT_ROOT directory, with the contents of the file being:
>>>
>>> <?php eval($_POST[1]);?>
>>>
>>> I didn't decode the remaining lines. I think they're just trying to do
>>> the same
>>> thing.
>>>
>>
>> Fortunately there is no webconfig.txt.php. And all folders in /srv/www
>> belongs to root and user wwwrun
>> is not allowed to write there.
>>
>
> What seems to be happening here is that your system is being probed for
> vulnerabilities.
>
> The attacker is sending a payload string to your index.php file in hopes
> that it will not complain and write the string to the file
> webconfig.txt.php which the attacker would then attempt to get to with the
> real hack in the Posted contents. Are there any requests to get to that
> file?
>
> You should make sure you sanitized any input to your index.php and reject
> anything that's not expected.
>
> Ken
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--94eb2c196fd412a82d0547dffeca
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">I see these type of attack strings all the time on Nginx =
except Nginx gives a 403. Apache is notoriously bad with security and givin=
g 200 ok responses makes you **** yourself. A reason =C2=A0I and many other=
 people have switched. User support on this list was also non existent when=
 I ran into serious SSL problems with 2.4 that until today have been ignore=
d and unanswered.=C2=A0</div><div class=3D"gmail_extra"><br><div class=3D"g=
mail_quote">On 06 Feb 2017 19:21, &quot;Ken Robinson&quot; &lt;<a href=3D"m=
ailto:kenrbnsn@rbnsn.com">kenrbnsn@rbnsn.com</a>&gt; wrote:<br type=3D"attr=
ibution"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex"><br>
<br>
On 2017-02-06 12:08 pm, Lentes, Bernd wrote:<br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><blockquote class=3D"gmail_quote" style=3D"m=
argin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The first line is trying to create the file webconfig.txt.php in your<br>
DOCUMENT_ROOT directory, with the contents of the file being:<br>
<br>
&lt;?php eval($_POST[1]);?&gt;<br>
<br>
I didn&#39;t decode the remaining lines. I think they&#39;re just trying to=
 do the same<br>
thing.<br>
</blockquote>
<br>
Fortunately there is no webconfig.txt.php. And all folders in /srv/www belo=
ngs to root and user wwwrun<br>
is not allowed to write there.<br>
</blockquote>
<br>
What seems to be happening here is that your system is being probed for vul=
nerabilities.<br>
<br>
The attacker is sending a payload string to your index.php file in hopes th=
at it will not complain and write the string to the file webconfig.txt.php =
which the attacker would then attempt to get to with the real hack in the P=
osted contents. Are there any requests to get to that file?<br>
<br>
You should make sure you sanitized any input to your index.php and reject a=
nything that&#39;s not expected.<br>
<br>
Ken<br>
<br>
------------------------------<wbr>------------------------------<wbr>-----=
----<br>
To unsubscribe, e-mail: <a href=3D"mailto:users-unsubscribe@httpd.apache.or=
g" target=3D"_blank">users-unsubscribe@httpd.apache<wbr>.org</a><br>
For additional commands, e-mail: <a href=3D"mailto:users-help@httpd.apache.=
org" target=3D"_blank">users-help@httpd.apache.org</a><br>
<br>
</blockquote></div></div>

--94eb2c196fd412a82d0547dffeca--