Weird Entry In Web Logs

Hi all, I'm getting some weird lines in my weblogs:

Quote:

---

222.110.47.149 - - [01/Mar/2006:11:00:39 -0800] "GET /\x1f\xdc.\xa0\xa2\x1f\x0f\xe80?c\xe0P\xfa`\xf2]\x1eO\xd6\xb3\xf1W\xd5\x97Ue\xc0\xd0\xbe\xfe\x17+\xff\x95\xab\x8a\xbfU\x17(\x03\xea\xe7\xad\xf2\xa5<\xf0\xf7\xedyM\xe7\xb5\xb3\x01\xcf__\x12\x87\xfe\xf0\x1f\xf8\xf8\xbe*\xd9\x07\xb5W\xe7\xb7\xea\xa1\x7f\xa2\x9c\xcd\xf9u\x85\xf22\xaa\xcf\x9a\xddV$\x17\xaa\x03\xe0s\xf6\x17}Z\xaf\xab\x1e\x17\xcf\x02\x8b\xfeU\xf07\xef_e/.\x96+\x9e\xff\x80\xfa\xa9\xffK\xf8\xef\xff\xf0\xe7\xaf\xafw\xe1\bIT\xaf\xc3\xe5bP\xfdQz\xbc\x1e\x17|\xb9_\x95\xfdMQ\xe5\x1e\xb3n\xdeLn\x9c\xdd\x1f\x89\xc4\xa0<\x07\xf9K\xfd\xff\xa8\xec\xff\x94c\xf1%22\xf9\\\xb2g\xe2\xb1+\xfcH\xce\xc7\x7f\xff\x87=}|%20\xa0\x1f\xf0\x18\x10R\xfe\xcb`\x1c\xffg\x8b\xa0\x97\xfb8\xd4\x12\xbf\xe1\xfd\xac\x17~+\x11\xa9\xfe\x18%\x0f\xe9u\x12\xe0\xf8\xbe\x89^\xb9\xf1\xfcU\xf0=\xeb\xceUx\xa2Q\xdf\xb9\xac\xc2\x7f\xff\xf0\xe7\xaf\xafh|\x10\x07\xe2Z\xa1$\xbc\xbb\xd6\xf8%20\x17\x01\xf2\xfe~\xf1L\xf3\x12\xf7\xb4\xbf\xb8%22\xe2\xff\x83D HTTP/1.0" 503 316 "http://www.irongeek.com/videos/ettercapfiltervid1.swf" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
222.110.47.149 - - [01/Mar/2006:11:00:39 -0800] "GET /\x828\xea\x83?\xf9\x9a\x01\xea\x87\xc5\xd4|\bP\xbf\xcaD\x85E\xea\xd5\x17\xab\xf1}UK\xf7\xea\x80\xef\x8b\x87\xde\xb3\xe2E\x12\x87\xe20\xe8z\xa2\x8e\xe5\x8e\xd4\x1f\x89%20~yT..\x12\x8b\x95_\xfe\x17\x17\x01\xfc\x1e\xabQ\x15\xab\xd1\xf9x\xfd^\xfe\x17\x17L\x1e\xa8\x03\x9c\xf4\xb7\xf5\xfbC\xf2\xfa%\x97\xfc\xbf\xf9\x14\xd1\x1b\xc22\xa8%22*U:\xa0\xb8\xbb\xd8\xa8\xbb\xc2%22\xa9<c\xff\xff\xe8\x04/\x17+\xfa\x85j\x87\xe5\xf6\x88\xca\x8b\x8b\xcb\x84\xa5\xea\xb2\xf5bYz\xa2\xf8\xab\xc5\xd2m\xd5J\x14)/V?.\x85\xc0\xd0\xbe\xe0A\xf0%20\x17?>?\xa2H\x92>V\x01\xe2X\x90\xa9X\x91|%P<$\x02\x82\x82\x84x?.\x1f\xa9\xa5\xfe\x12e\xf1u\xa3\xe1\xe2\x8c\xaa\xea\x90h?\xf4\x04\xa0\x86\x0f\x17\xaa HTTP/1.0" 503 316 "http://www.irongeek.com/videos/slack1.swf" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
222.110.47.149 - - [01/Mar/2006:11:00:39 -0800] "GET /\x1f\xdc.\xa0\xa2\x1f\x0f\xe80?c\xe0P\xfa`\xf2]\x1eO\xd6\xb3\xf1W\xd5\x97Ue\xc0\xd0\xbe\xfe\x17+\xff\x95\xab\x8a\xbfU\x17(\x03\xea\xe7\xad\xf2\xa5<\xf0\xf7\xedyM\xe7\xb5\xb3\x01\xcf__\x12\x87\xfe\xf0\x1f\xf8\xf8\xbe*\xd9\x07\xb5W\xe7\xb7\xea\xa1\x7f\xa2\x9c\xcd\xf9u\x85\xf22\xaa\xcf\x9a\xddV$\x17\xaa\x03\xe0s\xf6\x17}Z\xaf\xab\x1e\x17\xcf\x02\x8b\xfeU\xf07\xef_e/.\x96+\x9e\xff\x80\xfa\xa9\xffK\xf8\xef\xff\xf0\xe7\xaf\xafw\xe1\bIT\xaf\xc3\xe5bP\xfdQz\xbc\x1e\x17|\xb9_\x95\xfdMQ\xe5\x1e\xb3n\xdeLn\x9c\xdd\x1f\x89\xc4\xa0<\x07\xf9K\xfd\xff\xa8\xec\xff\x94c\xf1%22\xf9\\\xb2g\xe2\xb1+\xfcH\xce\xc7\x7f\xff\x87=}|%20\xa0\x1f\xf0\x18\x10R\xfe\xcb`\x1c\xffg\x8b\xa0\x97\xfb8\xd4\x12\xbf\xe1\xfd\xac\x17~+\x11\xa9\xfe\x18%\x0f\xe9u\x12\xe0\xf8\xbe\x89^\xb9\xf1\xfcU\xf0=\xeb\xceUx\xa2Q\xdf\xb9\xac\xc2\x7f\xff\xf0\xe7\xaf\xafh|\x10\x07\xe2Z\xa1$\xbc\xbb\xd6\xf8%20\x17\x01\xf2\xfe~\xf1L\xf3\x12\xf7\xb4\xbf\xb8%22\xe2\xff\x83D HTTP/1.0" 503 316 "http://www.irongeek.com/videos/ettercapfiltervid1.swf" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
222.110.47.149 - - [01/Mar/2006:11:00:39 -0800] "GET /\x828\xea\x83?\xf9\x9a\x01\xea\x87\xc5\xd4|\bP\xbf\xcaD\x85E\xea\xd5\x17\xab\xf1}UK\xf7\xea\x80\xef\x8b\x87\xde\xb3\xe2E\x12\x87\xe20\xe8z\xa2\x8e\xe5\x8e\xd4\x1f\x89%20~yT..\x12\x8b\x95_\xfe\x17\x17\x01\xfc\x1e\xabQ\x15\xab\xd1\xf9x\xfd^\xfe\x17\x17L\x1e\xa8\x03\x9c\xf4\xb7\xf5\xfbC\xf2\xfa%\x97\xfc\xbf\xf9\x14\xd1\x1b\xc22\xa8%22*U:\xa0\xb8\xbb\xd8\xa8\xbb\xc2%22\xa9<c\xff\xff\xe8\x04/\x17+\xfa\x85j\x87\xe5\xf6\x88\xca\x8b\x8b\xcb\x84\xa5\xea\xb2\xf5bYz\xa2\xf8\xab\xc5\xd2m\xd5J\x14)/V?.\x85\xc0\xd0\xbe\xe0A\xf0%20\x17?>?\xa2H\x92>V\x01\xe2X\x90\xa9X\x91|%P<$\x02\x82\x82\x84x?.\x1f\xa9\xa5\xfe\x12e\xf1u\xa3\xe1\xe2\x8c\xaa\xea\x90h?\xf4\x04\xa0\x86\x0f\x17\xaa HTTP/1.0" 503 316 "http://www.irongeek.com/videos/slack1.swf" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"

---

Does anyone recognize this as some sort of attack? Here is some info on the host:

x:~# whois 222.110.47.149
Çѱ¹ÀÎÅ�³��øÈï¿ø(NIDA)ÀÇ ÀÎÅ�³��¤º¸¼¾Å�(KRNIC)°¡ �¦°øÇ�´Â Whois ¼_ºñ½º ÀÔ´�´Ù.

query: 222.110.47.149

# KOREAN

�¶È¸°á°ú´Â ¾Æ·¡¿� °°À¸¸ç, ½Ç�¦ �¤º¸¿� »óÀÌÇÒ ¼ö ÀÖ½À´�´Ù.

IPv4 �Ö¼Ò : 222.110.47.128-222.110.47.255
³×Æ®¿öÅ© À̸§ : KORNET-INFRA000001
¿¬°á ISP¸Ã* : KORNET
ÇÒ´ç�¤º¸°ø°³¿©ºÎ : N

[ IPv4 »ç¿ë ±â°ü �¤º¸ ]
±â°ü°Ã*À¯¹øÈ£ : ORG1600
±â°ü¸Ã* : Çѱ¹Åë½Å
�Ö¼Ò : ¼º³²½Ã º�´ç±¸ �¤ÀÚµ¿ 206 Çѱ¹Åë½Å e-Bizº»ºÎ ±âȹÆÀ
¿ìÆÃ* ¹øÈ£ : 463-711

[ ³×Æ®¿öÅ© ´ã´çÀÚ Àι° �¤º¸ ]
±â°ü¸Ã* : Çѱ¹Åë½Å
�Ö¼Ò : ¼º³²½Ã º�´ç±¸ �¤ÀÚµ¿ 206 Çѱ¹Åë½Å e-Bizº»ºÎ ±âȹÆÀ
¿ìÆÃ* ¹øÈ£ : 463-711
ÀüÀÚ ¿ìÆÃ* : [email protected]

--------------------------------------------------------------------------------

¸¸¾Ã* ˤ˂ IPv4Ã�Ö¼Ò »ç¿ë±â°ü Ã�¤º¸°¡ ¿Ã¹Ù¸£Ã�ö ¾ÊÀ» °æ¿ì
¾Æ·¡ÀÇ ÇØ´ç ¿¬°á ISP ´ç´çÀÚ¿¡°Ô ¹®ÀÇÇ�½Ã±â ¹Ù¶ø´�´Ù.

[ ¿¬°áISPÀÇ IPv4�Ö¼Ò Ã¥ÀÓÀÚ �¤º¸ ]
À̸§ : IP�Ö¼Ò°ü¸®ÀÚ
ÀüÈ_ ¹øÈ£ : +82-2-3674-5708
ÀüÀÚ ¿ìÆÃ* : [email protected]

[ ¿¬°áISPÀÇ IPv4�Ö¼Ò °ü¸®ÀÚ �¤º¸ ]
À̸§ : IP�Ö¼Ò´ã´çÀÚ
ÀüÈ_ ¹øÈ£ : +82-2-3674-5708
ÀüÀÚ ¿ìÆÃ* : [email protected]

[ ¿¬°áISPÀÇ Network Abuse ´ã´çÀÚ �¤º¸ ]
À̸§ : ½ºÆÔ/ÇØÅ·´ã´ç
ÀüÈ_ ¹øÈ£ : 080-223-5577
ÀüÀÚ ¿ìÆÃ* : [email protected]

# ENGLISH

KRNIC is not an ISP but a National Internet Registry similar to APNIC.
The followings is organization information that is using the IPv4 address.

IPv4 Address : 222.110.47.128-222.110.47.255
Network Name : KORNET-INFRA000001
Connect ISP Name : KORNET
Publishes : N

[ Organization Information ]
Organization ID : ORG1600
Org Name : Korea Telecom
Address : GYUNGGI
Zip Code : 463-711

[ Technical Contact Information ]
Org Name : Korea Telecom
Address : 206, Jungja-dong, Bundang-gu, Sungnam-ci
Zip Code : 463-711
E-Mail : [email protected]

--------------------------------------------------------------------------------

If the above contacts are not reachable, please contact following ISP
for further information.

[ ISP IPv4 Admin Contact Information ]
Name : IP Administrator
Phone : +82-2-3674-5708
E-Mail : [email protected]

[ ISP IPv4 Tech Contact Information ]
Name : IP Manager
Phone : +82-2-3674-5708
E-Mail : [email protected]

[ ISP Network Abuse Contact Information ]
Name : Network Abuse
Phone : 080-223-5577
E-Mail : [email protected]


x:~# nmap -P0 -A 222.110.47.149

Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2006-03-02 01:57 CET
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Interesting ports on 222.110.47.149:
(The 1671 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE VERSION
8080/tcp open http Linksys WRT54G wireless-G router http config
Device type: router|broadband router|general purpose
Running: Cisco IOS 12.X, Conexant embedded, Draytek embedded, FreeSCO Linux 2.0.X, Linksys embedded, Linux 2.4.X|2.5.X, D-Link embedded, Siemens embedded
Too many fingerprints match this host to give specific OS details
Uptime 0.111 days (since Wed Mar 1 23:20:26 2006)
Service Info: Device: router

Nmap finished: 1 IP address (1 host up) scanned in 177.791 seconds

have you tried translation to hex, or even octal? looks like tetris to me...

























Yeah, that's an attempt to bust into your web site using one of the various buffer overflow attacks. Fortunately, you're responding with a 503, not a 200. Looks like some of the older nimda and CodeRed stuff, expanded. If you are not running IIS, this shouldn't be too much of a concern. If you are, you may want to look at how well your site is locked down, just for grins and giggles.

;)

It's Apache. It's just annoying having my log files filled with junk when I'm trying to look at recent visitors.

Do you have a way of filtering this type of incoming at a firewall or application firewall? That will help keep it out of your site logs.

Nope, it's not my box and my hosting provider does not seem to have an option for that.

If they are a commercial hosting service, you'd think they would have a perimeter filter in place. That would prevent most of this kind of thing. Granted, it doesn't directly attack your Apache installation at this time, but ...

'Course, it does just look like recon. Someone trying to find the odd vulnerable web server.

hmm, did find this, and I do quote:
"If you see these characters in any log file there is a good chance an attacker
is trying to mask his requests, or even trying to get around an IDS product.

Encoded characters mentioned in last paper/this paper.

%2e = . (Example: .. requests)
%3e = > (Example: Html/Javascript/SSI insertion. Mentioned in last paper)
%3c = < (Example: Html/Javascript/SSI insertion. Mentioned in last paper)
%2a = * (Examples Listed in chapter 2 of this paper)
%2b = + (Example: cmd.exe backdoor request. Also used as space)
%60 = ` (Examples Command execution. Mentioned in last paper)
%21 = ! (Example: SSI insertion. Mentioned in last paper)
%7c = | (Example: Command execution. Mentioned in last paper)
%3b = ; (Example: Command execution. Mentioned in last paper)
%7e = ~ (Examples Listed in chapter2 of this paper)
%3f = ? (Example: Php/Mentioned in last paper)
%5c = \ (Example: Possible Encoded Windows Directory Transversal Attempt)
%2f = / (Example: Possible Encoded Unix Directory Transversal Attempt)
%7b = { (Example: Possible trojan/backdoor upload attempt, possible command argument)
%7d = } (Example: Possible trojan/backdoor upload attempt, possible command argument)
%28 = ( (Example: Possible Cross Site Scripting attempt)
%29 = ) (Example: Possible Cross Site Scripting attempt)
%5b = [ (Example: Possible trojan/backdoor upload attempt, possible command argument)
%5d = ] (Example: Possible trojan/backdoor upload attempt, possible command argument)
%5e = ^ (Example: Possible trojan/backdoor upload attempt, possible command argument)


For a complete list of characters in Unix type "man ascii" and a list will be provided.
Below is what An example of directory transversal would look like while trying to fetch
the server's password file.


Example 1 :

h t t p:// host/ script.ext?template=%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64 <----- edited so this wouldnt turn into a url

This looks similar, info is at http://www.cgisecurity.com/papers/fi...nting-2.html#1

im going back to lurking now

Thanks, I'd give you antipoints but it says I have to spread them around. :)

Looks like they're trying to dig into directories that are deeper than most Windows computers allow. What they're trying to find, I don't know. Normally a hacked FTP server will have seemingly bottomless directories so that the person administering the FTP server can't easily delete them. The IP that did that is still online as I type this though. :D

Iron,

If the activity keeps up, contact the ASN for the network where the host resides and they will shut him down. Provide log data and the WHOIS info ofcourse.

If you need help, lemme know.


--TH13

Thanks. I've contacted my hosting provider about it, and if they can't/won't do something I'll take it to the next level.

Hi IG~

I wish you luck with Kornet, they have a very bad reputation. Basically they don't give a flying £$%&@# about what their customers do so long as they get paid :(

For anyone trying to decipher it.. It isn't ASCII but probably UTF-8 (unicode)..

I made a quick change to the coder thing that I posted a while back (changed the 0x it was looking for to \x) and got:

Quote:

---

Considering \xNN format: 222.110.47.149 - - [01/Mar/2006:11:00:39 -0800] "GET /.0? cP`]OWUe+U(& lt;yM__*Wu2V$s}ZU7_e/. +Kw\bITbPQz|_MQnLn& lt;Kc%22\\g+H=}|%20R`g8~+%u^U=UxQh|Z$%20~L%22D HTTP/1.0" 503 316 "http://www.irongeek.com/videos/ettercapfiltervid1.swf" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"

---

Not suprisingly it isn't all that helpful. I would guess given the source that the encoding is probably Korean and I can't help you with that, though maybe someone here could? :) Also keep in mind that some of the \x encoding might actually be assembly operations/opcodes which could also make figuring out what it was a little harder as well...

If you figure out anything, I'd be very curious to know what it was :)