4

Server was frozen, non responsive for about a day while I was away. Rebooting fixed it.

The Apache error log shows nothing at all, but the last thing present on the apache access log, before I rebooted, was a bunch of gibberish that starts with about a hundred repeating ^@ characters, then a few KB of (I'm guessing) binary payload-- stuff like "<80>è<86>då^S^H·F^M2^B®<8c>ØiGÌ.àV¨<90>".

What does this mean? What should I do?

9
  • 1
    While that specific exploit doesnt sound familiar, its always best to look for possible updates httpd, php, fastcgi, and/or any other web server technologies you use.
    – phemmer
    Feb 5, 2012 at 18:48
  • 1. Was the disk full? 2. How much memory did you have and how is your apache configured (MaxClients, MaxSpareXXX)?
    – Sacx
    Feb 8, 2012 at 12:28
  • 1
    how about the full log? Feb 8, 2012 at 23:52
  • 1
    sounds like mild filesystem corruption, not an exploit... Mar 9, 2012 at 22:05
  • 1
    Is the log filesystem XFS? With this fs I have seen file contents replaced by nulls (^@) after unexpected power loss or yanking power while system unresponsive. Given that you have been power cycling after a lockup, I would tend to agree with sendmoreinfo that filesystem corruption is far more likely
    – grifferz
    Mar 31, 2013 at 20:21

2 Answers 2

1

^0 is just a representation of ASCII 0 - if you do a man ascii you'll see the right column line up with the left values, an easy way to recall control characters. Unfortunately 0 is often used for null padding attack payloads (assuming you've ruled out a filesystem problem already).

The most important thing is what was prepending that junk - was it a script URL, a static resource, a module, etc? Somebody is either trying to exploit your system or fuzzing random systems looking for exploits.

That you got a crash means that something was successful - at least in causing the crash. It's a DoS at least, and often a crash (especially when they're trying to overrun buffers like that) can lead to a stack smash and running exploit code. That's bad, but it's not certain you were exploited (like others said, check for rootkits). If it's a certain repeating pattern you can use an iptables string match to prevent it from getting to Apache, but if your apache is up to date then you should report the exploit to Apache security too.

0

It does look like some sort of exploit. I'd run an rkhunter, and chkrootkit scan immediately. Updating once you're relatively sure you've not been compromised is helpful too. You might look at tripwire or OSSEC for further monitoring of the current situation.

Depending on your distribution rkhunter, and chkrootkit should be in your repositories.

While i dont know what ^@ translates to, if you see that many, it smells a bit like a nop sled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .