Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like:

66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 1170 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
200.78.247.148 - - [16/Mar/2010:15:26:05 +0800] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 506 "-" "-"
206.47.160.224 - - [16/Mar/2010:17:27:57 +0800] "GET / HTTP/1.1" 200 1170 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:02 +0800] "GET //phpmyadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:03 +0800] "GET //pma/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 476 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:04 +0800] "GET //admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 478 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:05 +0800] "GET //dbadmin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 479 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:05 +0800] "GET //mysql/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 479 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
190.220.14.195 - - [17/Mar/2010:01:28:06 +0800] "GET //php-my-admin/config/config.inc.php?p=phpinfo(); HTTP/1.1" 404 482 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"

What exactly is happening? Is it a really lame attempt at hacking in? Should I bother blocking the IP addresses these are from, or just leave it?

Edit: they apparently tried SSH as well. Amusingly they got nowhere near getting my name right. ;p

share|improve this question
5  
@Farseeker, what part surprises you about Windows 98? That there are still machines on the Internet, or that they are infected with malware. :p OTOH, it could have been forged and have come from something else. –  Zoredache Mar 16 '10 at 21:46
    
@Zoredache, the only '98 machines that are in the wild (that I've seen) belong to grandmothers. Although you're probably right about the malware, it's probably someone doing something via an infected host. Bloody script kiddies. I doubt that this guy is sophisticated enough to bother changing his user-agent. –  Mark Henderson Mar 16 '10 at 21:56
2  
It is because it is likely to be a compromised machine used in the first place that makes it pointless to hack it back. –  Richard Holloway Mar 16 '10 at 22:22
1  
Hmmm... A fake user-agent could also be used to distract. –  John Gardeniers Mar 17 '10 at 0:15

6 Answers 6

up vote 15 down vote accepted

I wouldn't expend the effort to try and deal with things like that manually, but I would be tempted to setup something like fail2ban if you haven't already.

share|improve this answer
    
well, most of the answers are good,but this seems to be the best of the lot –  Journeyman Geek Mar 17 '10 at 5:07
    
fail2ban is most often configured to block via IP - if the IP is spoofed, and it probably is - you'll have little luck. –  Ross May 8 '13 at 17:54
    
@Ross, HTTP is TCP-based. Spoofing TCP questions is far more difficult since a TCP handshake must be completed. Blocking addresses is somewhat effective. Sure the attacker might change his IP, or go through a different proxy. But TCP simply cannot be used with bi-directional communication, which means the source address must be valid, at least temporarily. See: serverfault.com/questions/90725/… –  Zoredache May 8 '13 at 18:16
    
If the IP address is spoofed, chances are it can' take a TCP session with a modern OS –  Michael Graff Apr 5 at 17:11
1  
I'd be more concerned with dynamic IPs - with the rise of IPs shared among ISPs customers at different times, and especially with the rise of carrier-grade NAT, you might find you're banning legitimate users once the hacker's IP address is allocated to someone else. The worst bit is - you'll never know you've done this as your audience cannot tell you, because they're banned! –  gbjbaanb Jul 29 at 12:02

yes, its script kiddies running standard "off-the-shelf" hacking scripts looking for servers that are vulnerable. If you're patched and firewalled and have all the usual things locked down, then I'd not worry too much about it - you'll get hack attempt all the time.

Of course, worry about not being patched, properly firewalled and having exploitable scripts/pages/apps running on your server. Keep an eye out for anything out of the ordinary and make sure you're notified of security updates and install them.

share|improve this answer

It is just background noise of the internet. It is not woth your time or energy to deal with it. If you have not setup fail2ban then you should do that but anything else is not needed. I have seen 10,000+ attempts like this in a just a day or two of logs.

share|improve this answer

I see very similar stuff in my logs all the time in my logs. My bet is that it's just a scanner that probably trawls much of the Internet looking for known holes to attack.

In other words, don't worry about it. Just make sure your system is up to date on its patches.

share|improve this answer

Here is a script I did "earlier" (i.e. years and years ago) to remove annoying 404s from the Apache error log.

#!/usr/bin/perl -w

# ===========================================================================
# Script kiddies and worms often try URLs behind which one can find
# specific vulnerabilities. This script writes a file to stdout that can then
# be included by httpd.conf so that known probed URLS result in 410s.
#
# See also: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html:
#
#  10.4.11 410 Gone
#
#  The requested resource is no longer available at the server and no
#  forwarding address is known. This condition is expected to be
#  considered permanent. Clients with link editing capabilities SHOULD
#  delete references to the Request-URI after user approval. If the
#  server does not know, or has no facility to determine, whether or
#  not the condition is permanent, the status code 404 (Not Found) SHOULD
#  be used instead. This response is cacheable unless indicated otherwise.
#
#  The 410 response is primarily intended to assist the task of web
#  maintenance by notifying the recipient that the resource is intentionally
#  unavailable and that the server owners desire that remote links to that
#  resource be removed. Such an event is common for limited-time, promotional
#  services and for resources belonging to individuals no longer working at
#  the server's site. It is not necessary to mark all permanently unavailable
#  resources as "gone" or to keep the mark for any length of time -- that is
#  left to the discretion of the server owner.
#
# WHY IS THIS INTERESTING
# -----------------------
#
# This setup removes the requests from the Apache httpd error log (the 
# requests no longer generate 'file not found' errors)
#
# This is is a good thing insofar as that list then becomes smaller (good
# for maintenance) and someone trying out more 'refined' vulnerabilities
# becomes visible (good for ringing the warning bell). It also tells
# script kiddies to go look elsewhere. On the other hand, a notable
# increase in probing might go unnoticed.
#
# If the website is configured to redirect requests for unknown URLs to the
# homepage, having this script saves on bandwidth for sure.
#
# Notes
# -----
#
# Probes for errors in HTTP protocol handling (bad headers etc) will still 
# show up in the log.
#
# -> analog webanalysis: The files still appear in the analog "failure 
#    request" log except if you set "STATUSEXCLUDE 410"
#
# -> You want to allow some URLs which are being probed as you really
#    might have the corresponding application installed (patched and
#    secured beforehand of course). Sometimes, adding further path elements
#    might be a solution to discriminate legit requests from probes.
#
# -> Performance impact? I have no idea.
#
# What matches
# ------------
#
# The "gone" URLs are just the start of URLs, so anything with an extension 
# will also match. There generally is no need to put the values into goneMatch.
# If you list "/forum3" as "gone", then the following will be marked "gone":
#
# /forum3
# //forum3   (which reduces to /forum3)
# /forum3/x
# /forum3//
#
# but not
#
# /forum3alpha
#
# If the website is configured to redirect requests for unknown URLs to the
# homepage, having this script saves both on bandwidth and noise in the web
# statistics.
# ===========================================================================

use List::MoreUtils qw(uniq); # yum install perl-List-MoreUtils

# Direct matching

@gone = makeGoneArray();

# Used for simple printing
# for my $x (@gone) { print "      $x\n" }; exit 1;

# Special matching ANYWHERE WITHIN AN URL.
# Lines terminated with a "$" will only match at the URL's end 
# (so "/data.tar" and "/data.tar?x=2" will match, but "/data.tar/foo" will not)
# Probes may check many versions of "phpMyAdmin" (like "/phpMyAdmin-2.6.0a" etc),
# so, that URL is in the "goneMatch" list:
# 2014-07: Found a bot actually scanning for backup files in the root; added!

@goneMatch = qw(xmlrpc\.php 
                nsiislog\.dll 
                jud\.cgi
                xmlrpc
                xmlsrv
                w00tw00t 
                proc\/self\/environ
                etc\/passwd
                /\.ht
                /\.svn/
                /\.svn$
                ^/phpMyAdmin
                /(site|data|pack|archive|zip|arch|all|export|exported|old|new|db|database|tgz|dump|backup|bckp|bak)\.(tar|tar\.gz|tgz|zip|rar|bz7)?$
);

# PRINT IT. The result is supposed to be installed by another script which
# checks whether the script currently in use has different content and 
# runs a graceful restart of Apache httpd. It also replaces %COPYMARK%
# with a tag indicating the installation operation.

print "# --------------------------------------------------------------------------\n";
print "# Use the perl script 'kiddie_be_gone.pl' to generate the contents below,\n";
print "# which are included by httpd.conf\n";
print "# Even easier, use ~q/httpd/sbin/install_kiddie_be_gone.sh\n";
print "# \%COPYMARK%\n";
print "# --------------------------------------------------------------------------\n";

#
# Some URLs in scan attacks are actually used by us! We allow them here.
#

# @allowed = ( '/administrator', '/main.php' );

@allowed = ();
%allowed = map { $_, 1 } @allowed;

{
   my $earlier = "";
   foreach my $entry (sort @gone) {
      # Eliminate duplicates, which is easy as the list is sorted
      if ($earlier eq $entry) {
         print STDERR "Duplicate 'gone' entry '$entry'; skipping it\n";
      }
      else {
         $earlier = $entry;
         if ($entry =~ /^(.*)\/$/) {
            print STDERR "Terminating slash in '$entry'; removed slash\n";
            $entry = $1;
         }
         if ($allowed{$entry})  {
            #
            # Some URLS in scan attacks are actually used by us! Filter them out
            #  
         }
         else {
            # 
            # Return a "410" - redirect gone
            #
            # See "http://httpd.apache.org/docs/2.2/mod/mod_alias.html#redirect" redirect instruction
            # Access to URLs yields error 410 - "Resource gone, no forwarding address"
            #
            # It would be cool to return a custom error code "444" - probe URL for example, but that
            # does not seem to be possible.
            #
            print "Redirect gone $entry\n";
         }
      }
   }
}

#
# Once again, for "RedirectMatch"
# 

{
   my $earlier = "";
   foreach my $entry (sort @goneMatch) {
      if ($earlier eq $entry) {
         print STDERR "Duplicate 'goneMatch' entry $entry\n";
      }
      else {
         $earlier = $entry;
         print "RedirectMatch gone $entry\n";
      }
   }
}

#######################################################################################
# Function to set up the URLs to which one responds "gone".
#
# "/\.ht" matches URLS which contain "/.ht", e.g. "/.htaccess"
# "/\.svn/" matches URLS which contain "/.svn/", i.e. anything requesting stuff under .svn 
# "/\.svn$ matches URLs which terminate in "/.svn", i.e. the request for the dir itself
# (What about requests for "encoded" URLs? like "/.s%76n/"? They seem to be caught, too)
#
# This list is at the end of the script for easier editing and subsequent appending
# using the usual Unix text processing tools.
#
# Use "sort --unique" on the array to manually recreate the list.
#######################################################################################

sub makeGoneArray {

   @series1 = qw(
      /*
      /..
      /..%5c..%5cwinnt
      /...
      /000
      /111
      /222
      /2phpmyadmin
      /333
      /3rdparty
      /444
      /555
      /666
      /777
      /888
      /999
      /AZ.php
      /BB
      /BBS1
      /BBS2
      /BE_config.php
      /BFormMail.pl
      /Blog
      /CFIDE
      /Cdma-cat.html
      /Count-cat.html
      /FastHTTPAuthScanner200test
      /Forum
      /Forums
      /Horde
      /Joomla
      /M83A
      /MSADC
      /MSOffice
      /MSOffice/cltreq.asp
      /MyAdmin
      /MySQLAdmin
      /MySQLDumper
      /NULL.IDA
      /NULL.ida
      /NULL.idq
      /NULL.printer
      /PBServer
      /PHPMYADMIN
      /PHPmyadmin
      /PMA
      /PMA2005
      /README
      /Rpc
      /SQL
      /SQLite
      /SQLiteManager
      /SQLiteManager-1.2.4
      /SQlite
      /SSLMySQLAdmin
      /Wordpress
      /\x85\x04\bsoapCaller.bs
      /_admin
      /_mem_bin
      /_phpMyAdmin
      /_phpmyadmin
      /_vti_bin
      /_vti_bin/owssvr.dll
      /_vti_cnf
      /_vti_inf.html
      /a.asp
      /achievo
      /adm
      /admin
      /admin/config/config.inc.php
      /admin/includes/general.js
      /admin/phpmyadmin2/index.php
      /admin/scripts/setup.php
      /admin_modules
      /admindump
      /administrator
      /adminsql
      /admm
      /admn
      /adsamples
      /agSearch
      /agenda.php3
      /agenda2.php3
      /apc-aa
      /appConf.htm
      /apps
      /appserv/main.php
      /assets
      /aws
      /awstats
      /awstats-cgibin
      /awstats.pl
      /awstatstotals
      /awstatstotals.php
      /azenv.php
      /b2b/admin/includes/stylesheet.css
      /backup
      /backups
      /backuptool
      /bak
      /bb
      /bbs
      /bck
      /bin/msgimport
      /bk
      /bkup
      /blogs
      /board
      /boards
      /bug/login_page.php
      /bugtracker/login_page.php
      /bulletinboard
      /bulletinboards
      /butik
      /c
      /c99.php
      /cart
      /catalog/admin/includes/stylesheet.css
      /cc
      /cgi
      /cgi-bin
      /cgi-bin/..
      /cgi-bin/azenv.pl
      /cgi-bin/check.bat
      /cgi-bin/ip1.cgi
      /cgi-bin/judge.cgi
      /cgi-bin/prxjdg.cgi
      /cgi-bin2
      /cgi-local
      /chat
      /chat1
      /chat2
      /chat3
      /chi-bin
      /class
      /cmd.php
      /cms
      /common
      /community
      /components
      /components/com_roundcube/CHANGELOG
      /config
      /configuration_administrator
      /content
      /cpadmin
      /cpadmindb
      /cpanelmysql
      /cpanelphpmyadmin
      /cpanelsql
      /cpdbadmin
      /cpphpmyadmin
      /createemails.inc.php
      /cube
      /cube/bin/msgimport
      /cvs
      /d
      /data_dump
      /database
      /databaseadmin
      /db
      /db/js/keyhandler.js
      /db/mysql/main.php
      /db/pma/main.php
      /db/scripts/setup.php
      /db/sql/main.php
      /db9
      /dbadmin
      /dbadmin/config/config.inc.php
      /dbdumper
      /dbsich
      /dbtw-wpd
      /default.ida
      /discussion
      /dmp
      /dmpr
      /domains
      /downloads
      /drupal
      /dump
      /dumper
      /ecommerce/admin/includes/stylesheet.css
      /ehcp
      /email/README
      /eshop/admin/includes/stylesheet.css
      /estadisticas
      /exchange
      /ezformml.cgi
      /fastenv
      /feed
      /fmail.pl
      /formmail.cgi
      /foros
      /forum
      /forum2
      /forum3
      /forums
      /freepbx
      /galaxy_
      /gallery
      /gb
      /getip.php
      /global
      /globals.php3
      /him.php
      /horde
      /horde-3.0.5
      /horde-3.0.6
      /horde-3.0.7
      /horde-3.0.8
      /horde-3.0.9
      /horde2
      /horde3
      /htdocs
      /httdocs
      /http
      /hudson
      /iisadmpwd
      /index.cgiupgrade_album.ph
      /index.phtml
      /intl
      /ip.cgi
      /ip.php
      /ip1.cgi
      /issue/login_page.php
      /issuetracker/login_page.php
      /jmx-console
      /joke
      /joomla
      /js
      /judge.php
      /judge112233.php
      /lib
      /lib_gor
      /libs
      /mail
      /mail/bin/msgimport
      /mail2
      /mails/README
      /mailz/README
      /main.php
      /mambo
      /mambots
      /manager
      /mantis/login_page.php
      /mantisbt/login_page.php
      /map.xml
      /members
      /mod_cbsms_messages.php
      /modules
      /msadc
      /msd
      /msd0.1
      /msd0.9.2
      /msd0.9.3c
      /msd1
      /msd1.14_Beta3
      /msd1.20
      /msd1.21
      /msd1.21.1
      /msd1.21.2
      /msd1.21.3
      /msd1.21.4
      /msd1.21.5
      /msd1.21.6
      /msd1.21.7
      /msd1.21.8
      /msd1.21.9
      /msd1.21b6
      /msd1.21stable
      /msd1.22
      /msd1.22.1
      /msd1.22.2
      /msd1.22.3
      /msd1.22.4
      /msd1.22.5
      /msd1.22.6
      /msd1.22.7
      /msd1.22.8
      /msd1.22.9
      /msd1.22stable
      /msd1.23
      /msd1.23.1
      /msd1.23.2
      /msd1.23.3
      /msd1.23.4
      /msd1.23.5
      /msd1.23.6
      /msd1.23.7
      /msd1.23.8
      /msd1.23.9
      /msd1.23stable
      /msd1.24
      /msd1.24.1
      /msd1.24.2
      /msd1.24.3
      /msd1.24.4
      /msd1.24.5
      /msd1.24.6
      /msd1.24.7
      /msd1.24.8
      /msd1.24.9
      /msd1.24RC1.5
      /msd1.24RC1.6
      /msd1.24RC1.7
      /msd1.24RC1.8
      /msd1.24stable
      /msd1.25
      /msd10
      /msd2
      /msd3
      /msd4
      /msd5
      /msd6
      /msd7
      /msd8
      /msd9
      /msdac
      /msdadmin
      /msdump
      /msdump0
      /msgboard
      /mss
      /mss2
      /mss2/bin/msgimport
      /mt-comments.cgi
      /muieblackcat
      /my
      /my-sql
      /myAdmin/config/config.inc.php
      /myAdmin/scripts/setup.php
      /mySqlDumper
      /myadmin
      /myadmin/config/config.inc.php
      /myadmin/scripts/setup.php
      /mysql
      /mysql-admin
      /mysql/config/config.inc.php
      /mysql/scripts/setup.php
      /mysqladmin
      /mysqladmin/scripts/setup.php
      /mysqladminconfig
      /mysqld
      /mysqldadmin
      /mysqldmp
      /mysqldump
      /mysqldump0
      /mysqldump3r
      /mysqldumpe
      /mysqldumper
      /mysqldumper0
      /mysqldumper01
      /mysqldumper02
      /mysqldumper03
      /mysqldumper04
      /mysqldumper05
      /mysqldumper06
      /mysqldumper07
      /mysqldumper08
      /mysqldumper09
      /mysqldumper1
      /mysqldumper1.24.1
      /mysqldumper1.24.2
      /mysqldumper1.24.3
      /mysqldumper1.24.4
      /mysqldumper10
      /mysqldumper2
      /mysqldumper3
      /mysqldumper4
      /mysqldumper5
      /mysqldumper6
      /mysqldumper7
      /mysqldumper8
      /mysqldumper9
      /mysqldumperadmin
      /mysqlmanager
      /nar
      /negozio/admin/includes/stylesheet.css
      /newboard
      /newboards
      /newmail
      /ok
      /openwebmail
      /p
      /p/m/a/config/config.inc.php
      /pHpMy
      /pHpMyAdMiN
      /pMA
      /padmin
      /php
      /php-my-admin
      /php-my-admin/config/config.inc.php
      /php-myadmin
      /phpAlbum
      /phpBB
      /phpBB2
      /phpLDAPadmin
      /phpMyA
      /phpMyAdmi
      /phpMyAdmin/scripts/setup.php
      /phpMyAds
      /phpMyChat
      /phpMyadmin
      /phpTest
      /phpTest/zologize/axa.php
      /phpThumb
      /phpThumb.php
      /phpadmin
      /phpadmin/js/keyhandler.js
      /phpadmin/scripts/setup.php
      /phpalbum
      /phpbb
      /phpdb
      /phpgroupware
      /phpldapadmin
      /phpm
      /phpmanager
      /phpmy
      /phpmy-admin
      /phpmyAdmin
      /phpmya
      /phpmyad
      /phpmyad-sys
      /phpmyadmin
      /phpmyadmin1
      /phpmyadmin2
      /phppgadmin
      /phppma
      /pma
      /pma/scripts/setup.php
      /pma2005
      /pmadmin
      /pmwiki
      /pmwiki.php
      /pmwiki2
      /portal
      /pp
      /ppmwiki
      /pr.php
      /presse
      /program
      /projects/login_page.php
      /proxy
      /proxy-1.php
      /proxyheader.php
      /qql
      /r
      /r57.php
      /rc
      /recordings
      /rms
      /root
      /round
      /round/bin
      /roundcube
      /roundcube-0.1
      /roundcube-0.2
      /roundcubemail
      /roundcubemail-0.1
      /roundcubemail-0.2
      /s-cgi
      /samples
      /scgi
      /scgi-bin
      /scoreboard
      /script
      /scripts
      /scripts/..
      /send_emails.inc.php
      /sicherung
      /siemens
      /sl2
      /soapCaller.bs
      /sql
      /sqladmin
      /sqldumper
      /sqlite
      /sqlitemanager
      /sqlmanager
      /sqlweb
      /sqlweb/config/config.inc.php
      /squirrelmail/CHANGELOG
      /ssa
      /stat
      /staticfiles
      /stats
      /stoma.php
      /stuff
      /sumthin
      /test
      /textenv.pl
      /thisdoesnotexistahaha.php
      /thumb
      /tmp
      /track
      /tracker/login_page.php
      /translators.html
      /trix/soapCaller.bs
      /trixbox/soapCaller.bs
      /typo3
      /ugboard
      /ugboards
      /undergraduate
      /underground
      /usage
      /user/soapCaller.bs
      /user/templates/footer.tpl
      /vhcs2
      /vhcs2/domain_default_page/index.html
      /vhcs2/soapCaller.bs
      /vhosts
      /vtigercrm
      /w
      /wbb2
      /web
      /webadmin
      /webdav
      /webdb
      /webmai
      /webmail
      /webmail2
      /websql
      /webstats
      /wiki
      /wikipedia
      /wm
      /wordpress
      /workflow-activities.php
      /wp
      /wp-admin
      /wp-admin/index.php
      /wp-content
      /wp-login.php
      /wp-phpmyadmin
      /www
      /wwwroot
      /xampp
      /zadmin
      /~
      /~root
      /configuration_administrator
      /administrator
      /blog
      /_phpmyadmin
      /apache-default
   );

   return uniq sort (@series1);

}
share|improve this answer

Checkout http://www.modsecurity.org/ too, can be configured to mitigate attacks on apache. You could think about using different servers for authenticated and non authenticated users. Thus to launch an attack on you main web application user would need to be fully authenticated.

Abusing users can the be denied access, or at least informed to clean their malwared machine up.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.