A malicious user has been trying to browse to strange URLs that don't exist on my server. One such request turned out to be url encoding:

%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E

This urldecoded to:

-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -n

This next one seems to be requesting an image

"J\x00\x00\x00&8B\x81\x90=Ve\xBE\x0C:\x8B7 m\xD8x\x8Eo\x83\xA9\x8D\xEB{'\xD8\x1A\xF0j\xB2\x95Mu}\x13\x5C\xB5\xAFe\xCD\xC6\xE7&N\xBA\x0B\xF1\xFB\xDCcD\x17\xCA]{H\x8AY\x90M\x04\xC5G\x83g\xF6\xB0U\xC2\xDEj\xE2\xE8n" 400 181 "-" "-"

What is this malicious user trying to do? This is a Ubuntu 14.04 server running nginx to serve up a django application.

  • -d auto_prepend_file=php://input if that worked the raw post body (would have been a post request) would run as php code. – AD7six Sep 12 '15 at 12:49
  • I'd block that IP and call it a day... – alexus Sep 12 '15 at 13:05
  • I blocked it, the attacker goes through a different proxy each time though so it's an ongoing threat. – Benjamin Pinkert Sep 12 '15 at 13:08
  • How might I disallow these types of requests? All of this is on top of constant brute-force ssh auth attempts – Benjamin Pinkert Sep 12 '15 at 13:09
  • some security hints here. – meuh Sep 12 '15 at 13:35

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.