PHWinfo - Afficher un message

12/05/2006, 12h05

hi
I've found a lot of these entries into my apache log, that is in the
combined format. I don't understand why the server responds with a 200 to
this request. Anyone knows which type of attack is?

Debian Sarge Apache 2.0.52
Thany you a lot
Antonino Mastronardi

aaa.bbb.ccc.ddd - - [12/May/2006:11:58:10 +0200] "GET /stat/sms.php
HTTP/1.1" 200 38029 "http://www.aaa.com/stat/sms.php"
"PBQLMLVADVFKAXNOGUMLBAYFCIFVCLASXDKHMUNHDXHJUKSAD JFDBBUERRBNYILXMQOCIODFKOJVWIALSSFFJVVPYHLKoPILQLV DIBzDCUMLEQVVARAPOEXKIPNMDJUJEWOEEBVYYBBUGIYIQPMQA iTMQFGGPBYSJHYWAVFBUXLSKDJLIQMDHLJIAUQWPGNLCXPSBQE PBGVOHTYSQOOGTGlLQLGMCDKUEUUIFCAVXNQSFYDMFJTTLYYCR JACETVWSJCXLCNKEVLEVTILSEAOEECDOJNRMCGQXYBVENVLXAE YKKXCBYQMRTIDlQVQEHWPONVWWIRUXUGVGBCSPFXFKOKPEYDNM GXPOVLKTQDCSXHVWGPHTDQCMUNTSVFASPRKXTADFODVCTRAMQL FUTXYMDEGPLAUNGTOMQOPAECIJGTUaEBMGB/LAESECUYQJNBTUAHSRIVYDDDIGXLYDQCLDDYHONKKVECHXDDJQ KENOUTEXSHDB4.CIXEKJQFXAGUHRXMTODOGHCLQOGUY0VUREXC XKAIMMAJIETIOJFQMDXOAVCHFUIYGMTUOPWEHGVQWLHEJVPVUQ JRYBIVTBCMQULMFRRERKYGMXPGSBMWJWXTKNMRXFKIQKCUWNRR QQBGVTUIMSYIQRDHFFPRJYUXYKXJHELLUHRKIQVBHVXJ
GAJBLUYLLJMAICIDLXAQOYTCQNOOERVNHLRXBTWVRFF(cWJRHM ITSSPYCCSHDMVSLOJWHHSSJQYKKKNAVOFJEESQHULLXXGXPVMQ IMKIHLCQRCXAUHDCEKJIEHLPBAVAXMJKMJWGOVERQRDNTLCSOC JQBMVQQDNTUQOLNoMPUDDVHRJJJBRODYAJDTUMVQRWJHWOmMNV ADTORCHWNPUVJKTYNEPTJETGTPBIIDURHEKULYMLNPJEEHPDVC CJRONJLEYUESIUDRQOKOUOMNDLOABWEEpCLELQTaNELYLYHKQK WTBNTTNYAPWLMQNJXBQMQJYHHQRSCYKMOYBJANJKHYKTFOYLKT IKLGIOMISHXQLTBEICWPHCYtQKMHBRXFWYIWCHLHRDIJLRUIPi JUWUYFOTJNANNSCGGWEVNAOQBPYNSXJEPCQOPECFWELWYABMFG UAODPONVTVbIMKLTHYINlRRWJUQWGCBWGKeVXYUUGYHD;SVLIH GXVJURBTKDUOYNOCBJICFWBUUHERSHWPLWITHMPBTWCWOWNQHU QRYAPAY
THXOJTFDERUULDYAFIMLXQJSWBKVOOVLTWYBGFNYGUHJECMYBU SGYFXYETCJGEGOULGYXJMVEIWQHGKBBPKPRYFKKNGPKMPRTBKC BAVSEECNFLSHRYDQKVBGLCKRPRWKMKSBTVBETRWWVFQKMTSREE SGNFFAVRCARMGRMELXNDKOWHXBLLMSYSFGGNNBXCPGGAYJGESV QEVGCLGGKRSMSUDPJOAHC
AYJGMYEYGYJHMEPBPRFREPBPNVWWT6DPIDVNABDOTFVYTAPYIV KDQCCJASKBDOWWHLSIJMP.QUWDNKVPYWTUTNJNASLKLNLYUBSX 0QYCCROTVLQ;XNPSOFCRVECOIPCVGWQAOJUOAVLMHRX
SFRKHURTJMTCQGTBMBXOGHIXLCFUKWLFTQVIBBHRTGFIWUNNTX XNWYiEXMPLIAJLWYOTKYYFYRTXDIODEOTAJJVGREHSTCRTVXUG VMXBXCDYGQOMFGTCXDGVPYXIHHNNDFFSYSTEXJHKCFSHPUJISA ARQMnBXOKXVCLMQVOBTMEYdDRVQRGEJKEYHPPAHBOCNCXQNADU FFMINWIVBRJWCTACKTIoHVODJNLSPWCOELDTLFWDVHWXRwBVKY WJPXUTCBXILJPUSFADYIHRFLUKTNWEGDXJVKQAVJVSKLOEAOTM XJBWOHKBTYYUXNsWYNKNNSOPGWWTUBBGDOHAJFKSKLDBE
ONHMKGLNBNOFDCBUJPNPBKRGWKSGYAYXFTCCHRSFAJJNFJTAGJ RVBVXCVVNTAGVXGMSECJBRFICGMUSXSRTTDXFGJOQYHNPHOTXW JFVGSSLETHLKSECTCGQFLQQFKRFILLUPEDXKAEERAQCKDOWTIK
YDFUFKPIWFEFSXWLLWY5TWYJRLMKBQCIFNBRFSVGFWCHFDNSPS SJGSMBNCRCMVETACBJEKHBWSHEWYOIE.TMVKPYGUSWKQLUOGVN TRC1BAHCIOCWXFBEXDLGPICUFTQEXVRGAANSEELNRKJPBNVFMM LLVYBBVVIOMNEHSCDPTQHGCIGRJHOKINBBHTODBI;XOAVQIVNU PTVGONDIVEUWIWTWGVGGXHXGCJLQNORTDGCEXQAJXTPTWGWSAB GODARBJAKRUVUFRTWOQCNATYDUKMYGWPFKKLKIBOUPYIKGATTM VHGYCMIJTGFQEVQTEJTDUKNQOBBCOKFVVVSLTDPLJMBNIYVIWD YOBDFULVLACW
FRGKOHVEVGEJTNNGUCGIHFXCYRWGHQDOSQGUEXDLAGPYPTTRMG UCECPWTVIIARJUVHERPDHIGQLPTDSSFODOTWBIWBYCGXQBAYLV HWGVILNRECGKNDWQYHGQRGHRHGMOHEGIVATPCAIH1OJYXG;PTE SQEKD
YTIEKOVBSBGSVYIAJCILMXVBYONYAHTHXCUDLFFU.JHSXJQUCX JXRDAXIXQOXGMGYOCGEHDJKIVYBABAUVVCSCKQWUFKECEUWHUQ KGTPXBLTFFVXPMYBNETTPQXHTSHRNXAQMLKRMUTBINAETPPSFE XPRTFEKAVEHMAPXPHLHISRYKBQJDOVKLVDGBEDYMTMXH
WUUKHKXUDHSONROYTJPPNWFXFTXTELRSJICNDLERRSPKUOVGAT VAEONLUCHGBOTFXSLXJBVTKGXRSALKYLDISVKYPVBCQBDBRCGA QXDXELLACLPAJNOEXMEFDDBGLUETQSJOLLVKPDYJPQNNWTVFYO HJLEDRKJRKNWMWVBGYWUJLFATJDBDWFCIGGESJFEFFLBIUIGIC SRFHWLGMYMCYARLRNWXIKYFGATJTOTJHXWTDGVTAORHPCXABSH MYGQ
NGTHGHPFFQKSNHSMPLEKAOWAUJGDTSIXIEDQJBQFSYIK1OXYJR FGDTTMDUYDXBMBDECTDFIBJKLBBSFQVVXNOMNWUXFHSRTJPPIB EOLOBTKTHBDFVBSNPNEORLU.OC1DEDWYXCDFOVHUVANQTXJCKJ SGCQKGBWFIQFMPNTDFXYAQJJDIVDUGJOEMIBVPGRNNNSUNH.U4 MDHBWDFTLPHHAKEQEGLJDUMEVAUF3TBGSEIBFHDVQPGL2VJCIT YESSHTNMRGALKTXEXCBVNYCWKYAKPWPQPFCPFNI2SXTASWNPPD HPAYJHOGTUP;FVGSIILADPCBCJBGGGTQNMQTTNRWCIFLAVUOM
FHJYBNYKMDIJQLAGETCDIYnCVTFLUXFITFNKDFSVQSDOEAFfYA XMHNIVDTXRWPJHASJJTHFKHTJDBARFLTCSYIVLVQOBXEUCRAOE BRoHPBLNSARBVHIBORSVHYPTUBTAWFSVDBLBBBLMFRJDUGISYF EKUDETBGARAWILUJBXYWLPMUOMYPPUTaQtJAHSRJPOUVFWMSDU QWNPJJEJERUMABEEVLGIRHYAUWLJRFUTIBGCBDJOSMKQKXPYNY TKNDXHCYVKVNCTBKJFTJIhFDQLVHDUJLRQAPCLPELDLSPBCYTD OY.EFOQGDTCORCOYBKEJQNRGHRPCETCDHGJAKW2IXNVMODVOWM WGQMVSCSWKDWFOKADUSWFBJIKEXGDBUFONEPJORHGGOSBMKIRK JNQLIIWRWUOIWLRBPIPXWXBEKIHTCFPAUVVWOIGURDLJUQWGTC QBBPSVFDVCTOJGRALSXDFQHFHIXMPCHVUPGUFFCDOMHYOF;HAK NROGNFIEARSXGUDEVIVIKNEPPPHEDHMPBKMDBJIROWNHBXXSHS KDLBGICESYGFMFWNPDDGUCEHGABFILPNU
XUATOPLLXKXBKBURENEEVVYL.WHYXEWPYCARYMDCERKGHTLLUJ RCFKUOSTMEOERUNNYDNXMQFXGSDNOJXCHLEQWLEBWMQOHNJVWR DPJQBLMMDQJEMTVVPCFTHAKEPHVKAICHUHNYAUUQISJEWRGGPX IYMIFQFWYPJPXTTQTXFPFQKYDHVHC
SKANYVBFMMCAVWDCGBTNLXECKHRRDIWGRNYORULWMEHRLKFJOI PQQTUBSVMMIFBCBBKWTFJFGOEYAAHJFOPVNGNMPHYRVIQQXTXH TSOVMYSQCXILCAHLSHKNWYJRVNAFJCRPSQANIUAHLFEHINVUBO YUNRWROKV
WHAOKGQPQG2OJUFSUVMRATNVDTSTEUQYOOJTSPDQGWMSTGUNPA IUSLPIJPMDPPOIICJCFORSERPDNJM.IHNKWOCG0JWMMWJIAC.V UKJWDCPVLILPDQONPFYHDWCGMAVMBWGWHEGJGAQCNEQGOOFLRI VVGLYHTIKIGCXNGEJOIVFRQJSBLGRBVRGCDJOLLRQBMYVHJPOG NTYUE5OIVADKVNJVGRDNOAKTEQMBESVCFVRLQUPLFRJURUKJIE STOITEPRXTETXKEXMQIPSVGXEGLKRQJUYLXCVTC0NBIHMKGLJO AQK72GNNWVSKYADTXIJKFMMLFRHCFKQMWHQVCNQKDMEWDIIMWR ADEQBTFWOCICDHJXUXN7GKDQTFSDYBLLSYLMDDIUWDGRXHSFAI QHVTWCNMMRGEMHYEXQQXGKSEDUBANCRTDFPTMDYESTQYHJWLQT QNLEGBUTOWS)"

12/05/2006, 12h05	#1
antonino Messages: n/a Hébergeur:	Is my server being cracked? hi I've found a lot of these entries into my apache log, that is in the combined format. I don't understand why the server responds with a 200 to this request. Anyone knows which type of attack is? Debian Sarge Apache 2.0.52 Thany you a lot Antonino Mastronardi aaa.bbb.ccc.ddd - - [12/May/2006:11:58:10 +0200] "GET /stat/sms.php HTTP/1.1" 200 38029 "http://www.aaa.com/stat/sms.php" "PBQLMLVADVFKAXNOGUMLBAYFCIFVCLASXDKHMUNHDXHJUKSAD JFDBBUERRBNYILXMQOCIODFKOJVWIALSSFFJVVPYHLKoPILQLV DIBzDCUMLEQVVARAPOEXKIPNMDJUJEWOEEBVYYBBUGIYIQPMQA iTMQFGGPBYSJHYWAVFBUXLSKDJLIQMDHLJIAUQWPGNLCXPSBQE PBGVOHTYSQOOGTGlLQLGMCDKUEUUIFCAVXNQSFYDMFJTTLYYCR JACETVWSJCXLCNKEVLEVTILSEAOEECDOJNRMCGQXYBVENVLXAE YKKXCBYQMRTIDlQVQEHWPONVWWIRUXUGVGBCSPFXFKOKPEYDNM GXPOVLKTQDCSXHVWGPHTDQCMUNTSVFASPRKXTADFODVCTRAMQL FUTXYMDEGPLAUNGTOMQOPAECIJGTUaEBMGB/LAESECUYQJNBTUAHSRIVYDDDIGXLYDQCLDDYHONKKVECHXDDJQ KENOUTEXSHDB4.CIXEKJQFXAGUHRXMTODOGHCLQOGUY0VUREXC XKAIMMAJIETIOJFQMDXOAVCHFUIYGMTUOPWEHGVQWLHEJVPVUQ JRYBIVTBCMQULMFRRERKYGMXPGSBMWJWXTKNMRXFKIQKCUWNRR QQBGVTUIMSYIQRDHFFPRJYUXYKXJHELLUHRKIQVBHVXJ GAJBLUYLLJMAICIDLXAQOYTCQNOOERVNHLRXBTWVRFF(cWJRHM ITSSPYCCSHDMVSLOJWHHSSJQYKKKNAVOFJEESQHULLXXGXPVMQ IMKIHLCQRCXAUHDCEKJIEHLPBAVAXMJKMJWGOVERQRDNTLCSOC JQBMVQQDNTUQOLNoMPUDDVHRJJJBRODYAJDTUMVQRWJHWOmMNV ADTORCHWNPUVJKTYNEPTJETGTPBIIDURHEKULYMLNPJEEHPDVC CJRONJLEYUESIUDRQOKOUOMNDLOABWEEpCLELQTaNELYLYHKQK WTBNTTNYAPWLMQNJXBQMQJYHHQRSCYKMOYBJANJKHYKTFOYLKT IKLGIOMISHXQLTBEICWPHCYtQKMHBRXFWYIWCHLHRDIJLRUIPi JUWUYFOTJNANNSCGGWEVNAOQBPYNSXJEPCQOPECFWELWYABMFG UAODPONVTVbIMKLTHYINlRRWJUQWGCBWGKeVXYUUGYHD;SVLIH GXVJURBTKDUOYNOCBJICFWBUUHERSHWPLWITHMPBTWCWOWNQHU QRYAPAY THXOJTFDERUULDYAFIMLXQJSWBKVOOVLTWYBGFNYGUHJECMYBU SGYFXYETCJGEGOULGYXJMVEIWQHGKBBPKPRYFKKNGPKMPRTBKC BAVSEECNFLSHRYDQKVBGLCKRPRWKMKSBTVBETRWWVFQKMTSREE SGNFFAVRCARMGRMELXNDKOWHXBLLMSYSFGGNNBXCPGGAYJGESV QEVGCLGGKRSMSUDPJOAHC AYJGMYEYGYJHMEPBPRFREPBPNVWWT6DPIDVNABDOTFVYTAPYIV KDQCCJASKBDOWWHLSIJMP.QUWDNKVPYWTUTNJNASLKLNLYUBSX 0QYCCROTVLQ;XNPSOFCRVECOIPCVGWQAOJUOAVLMHRX SFRKHURTJMTCQGTBMBXOGHIXLCFUKWLFTQVIBBHRTGFIWUNNTX XNWYiEXMPLIAJLWYOTKYYFYRTXDIODEOTAJJVGREHSTCRTVXUG VMXBXCDYGQOMFGTCXDGVPYXIHHNNDFFSYSTEXJHKCFSHPUJISA ARQMnBXOKXVCLMQVOBTMEYdDRVQRGEJKEYHPPAHBOCNCXQNADU FFMINWIVBRJWCTACKTIoHVODJNLSPWCOELDTLFWDVHWXRwBVKY WJPXUTCBXILJPUSFADYIHRFLUKTNWEGDXJVKQAVJVSKLOEAOTM XJBWOHKBTYYUXNsWYNKNNSOPGWWTUBBGDOHAJFKSKLDBE ONHMKGLNBNOFDCBUJPNPBKRGWKSGYAYXFTCCHRSFAJJNFJTAGJ RVBVXCVVNTAGVXGMSECJBRFICGMUSXSRTTDXFGJOQYHNPHOTXW JFVGSSLETHLKSECTCGQFLQQFKRFILLUPEDXKAEERAQCKDOWTIK YDFUFKPIWFEFSXWLLWY5TWYJRLMKBQCIFNBRFSVGFWCHFDNSPS SJGSMBNCRCMVETACBJEKHBWSHEWYOIE.TMVKPYGUSWKQLUOGVN TRC1BAHCIOCWXFBEXDLGPICUFTQEXVRGAANSEELNRKJPBNVFMM LLVYBBVVIOMNEHSCDPTQHGCIGRJHOKINBBHTODBI;XOAVQIVNU PTVGONDIVEUWIWTWGVGGXHXGCJLQNORTDGCEXQAJXTPTWGWSAB GODARBJAKRUVUFRTWOQCNATYDUKMYGWPFKKLKIBOUPYIKGATTM VHGYCMIJTGFQEVQTEJTDUKNQOBBCOKFVVVSLTDPLJMBNIYVIWD YOBDFULVLACW FRGKOHVEVGEJTNNGUCGIHFXCYRWGHQDOSQGUEXDLAGPYPTTRMG UCECPWTVIIARJUVHERPDHIGQLPTDSSFODOTWBIWBYCGXQBAYLV HWGVILNRECGKNDWQYHGQRGHRHGMOHEGIVATPCAIH1OJYXG;PTE SQEKD YTIEKOVBSBGSVYIAJCILMXVBYONYAHTHXCUDLFFU.JHSXJQUCX JXRDAXIXQOXGMGYOCGEHDJKIVYBABAUVVCSCKQWUFKECEUWHUQ KGTPXBLTFFVXPMYBNETTPQXHTSHRNXAQMLKRMUTBINAETPPSFE XPRTFEKAVEHMAPXPHLHISRYKBQJDOVKLVDGBEDYMTMXH WUUKHKXUDHSONROYTJPPNWFXFTXTELRSJICNDLERRSPKUOVGAT VAEONLUCHGBOTFXSLXJBVTKGXRSALKYLDISVKYPVBCQBDBRCGA QXDXELLACLPAJNOEXMEFDDBGLUETQSJOLLVKPDYJPQNNWTVFYO HJLEDRKJRKNWMWVBGYWUJLFATJDBDWFCIGGESJFEFFLBIUIGIC SRFHWLGMYMCYARLRNWXIKYFGATJTOTJHXWTDGVTAORHPCXABSH MYGQ NGTHGHPFFQKSNHSMPLEKAOWAUJGDTSIXIEDQJBQFSYIK1OXYJR FGDTTMDUYDXBMBDECTDFIBJKLBBSFQVVXNOMNWUXFHSRTJPPIB EOLOBTKTHBDFVBSNPNEORLU.OC1DEDWYXCDFOVHUVANQTXJCKJ SGCQKGBWFIQFMPNTDFXYAQJJDIVDUGJOEMIBVPGRNNNSUNH.U4 MDHBWDFTLPHHAKEQEGLJDUMEVAUF3TBGSEIBFHDVQPGL2VJCIT YESSHTNMRGALKTXEXCBVNYCWKYAKPWPQPFCPFNI2SXTASWNPPD HPAYJHOGTUP;FVGSIILADPCBCJBGGGTQNMQTTNRWCIFLAVUOM FHJYBNYKMDIJQLAGETCDIYnCVTFLUXFITFNKDFSVQSDOEAFfYA XMHNIVDTXRWPJHASJJTHFKHTJDBARFLTCSYIVLVQOBXEUCRAOE BRoHPBLNSARBVHIBORSVHYPTUBTAWFSVDBLBBBLMFRJDUGISYF EKUDETBGARAWILUJBXYWLPMUOMYPPUTaQtJAHSRJPOUVFWMSDU QWNPJJEJERUMABEEVLGIRHYAUWLJRFUTIBGCBDJOSMKQKXPYNY TKNDXHCYVKVNCTBKJFTJIhFDQLVHDUJLRQAPCLPELDLSPBCYTD OY.EFOQGDTCORCOYBKEJQNRGHRPCETCDHGJAKW2IXNVMODVOWM WGQMVSCSWKDWFOKADUSWFBJIKEXGDBUFONEPJORHGGOSBMKIRK JNQLIIWRWUOIWLRBPIPXWXBEKIHTCFPAUVVWOIGURDLJUQWGTC QBBPSVFDVCTOJGRALSXDFQHFHIXMPCHVUPGUFFCDOMHYOF;HAK NROGNFIEARSXGUDEVIVIKNEPPPHEDHMPBKMDBJIROWNHBXXSHS KDLBGICESYGFMFWNPDDGUCEHGABFILPNU XUATOPLLXKXBKBURENEEVVYL.WHYXEWPYCARYMDCERKGHTLLUJ RCFKUOSTMEOERUNNYDNXMQFXGSDNOJXCHLEQWLEBWMQOHNJVWR DPJQBLMMDQJEMTVVPCFTHAKEPHVKAICHUHNYAUUQISJEWRGGPX IYMIFQFWYPJPXTTQTXFPFQKYDHVHC SKANYVBFMMCAVWDCGBTNLXECKHRRDIWGRNYORULWMEHRLKFJOI PQQTUBSVMMIFBCBBKWTFJFGOEYAAHJFOPVNGNMPHYRVIQQXTXH TSOVMYSQCXILCAHLSHKNWYJRVNAFJCRPSQANIUAHLFEHINVUBO YUNRWROKV WHAOKGQPQG2OJUFSUVMRATNVDTSTEUQYOOJTSPDQGWMSTGUNPA IUSLPIJPMDPPOIICJCFORSERPDNJM.IHNKWOCG0JWMMWJIAC.V UKJWDCPVLILPDQONPFYHDWCGMAVMBWGWHEGJGAQCNEQGOOFLRI VVGLYHTIKIGCXNGEJOIVFRQJSBLGRBVRGCDJOLLRQBMYVHJPOG NTYUE5OIVADKVNJVGRDNOAKTEQMBESVCFVRLQUPLFRJURUKJIE STOITEPRXTETXKEXMQIPSVGXEGLKRQJUYLXCVTC0NBIHMKGLJO AQK72GNNWVSKYADTXIJKFMMLFRHCFKQMWHQVCNQKDMEWDIIMWR ADEQBTFWOCICDHJXUXN7GKDQTFSDYBLLSYLMDDIUWDGRXHSFAI QHVTWCNMMRGEMHYEXQQXGKSEDUBANCRTDFPTMDYESTQYHJWLQT QNLEGBUTOWS)"