Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Server was frozen, non responsive for about a day while I was away. Rebooting fixed it.

The Apache error log shows nothing at all, but the last thing present on the apache access log, before I rebooted, was a bunch of gibberish that starts with about a hundred repeating ^@ characters, then a few KB of (I'm guessing) binary payload-- stuff like "<80>è<86>då^S^H·F^M2^B®<8c>ØiGÌ.àV¨<90>".

What does this mean? What should I do?

share|improve this question
1  
While that specific exploit doesnt sound familiar, its always best to look for possible updates httpd, php, fastcgi, and/or any other web server technologies you use. –  Patrick Feb 5 '12 at 18:48
    
1. Was the disk full? 2. How much memory did you have and how is your apache configured (MaxClients, MaxSpareXXX)? –  Sacx Feb 8 '12 at 12:28
1  
how about the full log? –  The Unix Janitor Feb 8 '12 at 23:52
1  
sounds like mild filesystem corruption, not an exploit... –  sendmoreinfo Mar 9 '12 at 22:05
1  
Is the log filesystem XFS? With this fs I have seen file contents replaced by nulls (^@) after unexpected power loss or yanking power while system unresponsive. Given that you have been power cycling after a lockup, I would tend to agree with sendmoreinfo that filesystem corruption is far more likely –  grifferz Mar 31 '13 at 20:21

2 Answers 2

^0 is just a representation of ASCII 0 - if you do a man ascii you'll see the right column line up with the left values, an easy way to recall control characters. Unfortunately 0 is often used for null padding attack payloads (assuming you've ruled out a filesystem problem already).

The most important thing is what was prepending that junk - was it a script URL, a static resource, a module, etc? Somebody is either trying to exploit your system or fuzzing random systems looking for exploits.

That you got a crash means that something was successful - at least in causing the crash. It's a DoS at least, and often a crash (especially when they're trying to overrun buffers like that) can lead to a stack smash and running exploit code. That's bad, but it's not certain you were exploited (like others said, check for rootkits). If it's a certain repeating pattern you can use an iptables string match to prevent it from getting to Apache, but if your apache is up to date then you should report the exploit to Apache security too.

share|improve this answer

It does look like some sort of exploit. I'd run an rkhunter, and chkrootkit scan immediately. Updating once you're relatively sure you've not been compromised is helpful too. You might look at tripwire or OSSEC for further monitoring of the current situation.

Depending on your distribution rkhunter, and chkrootkit should be in your repositories.

While i dont know what ^@ translates to, if you see that many, it smells a bit like a nop sled.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.