Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I was walking through my server logs and the following kinda stunned me:

ACCESS ERROR 404 from IP 62.112.152.161:
    Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00

ACCESS ERROR 404 from IP 62.112.152.161:
    Path: /download.php?dlfilename=../../../../../../../../etc/passwd%00

ACCESS ERROR 404 from IP 62.112.152.161:
    Path: /download.php?filename=../../../../../../../../etc/passwd%00

ACCESS ERROR 404 from IP 62.112.152.161:
    Path: /agb.php?lang=../../../../../../../../etc/passwd%00

ACCESS ERROR 404 from IP 62.112.152.161:
    Path: /angemeldet.php?lang=../../../../../../../../etc/passwd%00

There were lot's more variations, always triyng to get the same file. They wouldn't succeed even if there was some "download.php"*, but I'm curious what would it do if they did.
Also, I wonder if there's something I can do against this BOT in more global scope, to help other webmasters who might have their site vulnerable against such attack.

Unfortunatelly, HTTP headers were not registered.

*I'm running on virtual server where PHP's top dir is the website's root.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Ironically, this is exactly the kinds of things I study in my automated security analysis research.

The bot is trying to take advantage of a PHP application vulnerability to read your password file. With success, the hacker would attempt to log into various resources including the PHP application that hosted the vulnerability, as well as, other PHP applications and services such as FTP, SMTP, SSH, etc.

You can either block the ip address and/or domain name, use a regex in your .htaccess file, or (preferred) use mod_security to block these attempts.

Mod_Security is preferred since it covers a multitude of attacks. http://www.modsecurity.org/

This is likely a compromised system that was hacked in the same way. It is likely executing a script or executable and may hit may sites before long. I do not have and attacks from this IP address in my database so it is likely new.

IP: 62.112.152.161 / Netdiscounter GmbH autonomous system - Domain Name: 441.hosttech.eu

I have other PHP application vulnerability hack attempt entries for:

190.hosttech.eu [ip: 82.220.34.55, asn: AS9044, BSE Software GmbH] (Sun Aug 19 2012)

sh-501.premium.hosttech.eu [ip: 176.9.138.35, asn: AS24940, Hetzner Online AG] (Thu Jun 6 2013)

share|improve this answer
    
I just had an attack: --- A user with IP address 79.182.60.204 has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 20. The last username theytried to sign in with was: 'admin' User IP: 79.182.60.204 User hostname: bzq-79-182-60-204.red.bezeqint.net --- I contacted bezeqint.net, but the mailbox there was full. Is this IP in your database? –  Leo Jun 14 at 1:40
    
@Leo bzq-79-182-60-204.red.bezeqint.net is not in my database, but there are 284 just like it! This is a well known network for abuses. For what it is worth, my website has cut and paste .htaccess block code that can help. My site is being revamped and expanded rapidly, so it is not as pretty as I would like, but it is functional! In fact, I am adding at least 50k domain names and IP addresses and at least 5 more major subject areas. –  closetnoc Jun 14 at 2:08
    
I get a lot of "Restricted" when trying to view your site. I just looked for a way to contact you here, but I can't find any. Perhaps you can contact me? (I have no idea how this works here on StackExchange.) –  Leo Jun 14 at 11:09
    
@Leo My bad!! I am having trouble with the decay algorithm and went back to a static number for a bit while I restructure the decay method. I just set the static number too high I guess. The primary reason for this site is experimentation. I set the static number quite a bit lower. In this case, it is all about access speed. It is a matter of click speed and page request speed. There is more, but not for browsers. Sorry for the problem! –  closetnoc Jun 15 at 0:53
    
Thanks @closetnoc, now I can read your site (after deleting cookies etc). –  Leo Jun 15 at 2:18
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.