Found this in my raw logs - wtf is it? - GoFuckYourself.com

chupachups · 04-26-2006, 08:35 AM

Anyone know? Some overflow shit?

193.X.X.X - - [25/Apr/2006:05:45:07 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04Hx04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04Hx04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4Hx90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90x90\x 90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x 90\x90\x90\x90\x90\x90\x90" 414 333 "-" "-"

chadglni · 04-26-2006, 08:37 AM

Mark of the beast. Turn it upside down and you'll see all the 6's.

chupachups · 04-26-2006, 08:39 AM

Quote:

Originally Posted by chadglni

Mark of the beast. Turn it upside down and you'll see all the 6's.

So Eddie has been visiting me?

mardigras · 04-26-2006, 08:41 AM

Obviously a H4x0r

The Truth Hurts · 04-26-2006, 08:44 AM

RS_IIS.C exploit

tyler. · 04-26-2006, 08:45 AM

that is some freaky shit

zigx · 04-26-2006, 08:48 AM

the code is just encoded to hex

kursk · 04-26-2006, 08:49 AM

you've been hacked by Alkeida

mardigras · 04-26-2006, 08:51 AM

Quote:

Originally Posted by The Truth Hurts

RS_IIS.C exploit

I just Googled that and a posting gave a similar log entry and some information about the exploit. Definitely something you want to get patched, chupachups

chupachups · 04-26-2006, 08:53 AM

Quote:

Originally Posted by mardigras

I just Googled that and a posting gave a similar log entry and some information about the exploit. Definitely something you want to get patched, chupachups

Thx guys - checking in now

madawgz · 04-26-2006, 08:53 AM

Quote:

Originally Posted by kursk

you've been hacked by Alkeida

nah - they are too busy trying to destroy the world...do they have internet?

chupachups · 04-26-2006, 08:56 AM

Quote:

Originally Posted by madawgz

nah - they are too busy trying to destroy the world...do they have internet?

I suspect you are a racialist!!!

mardigras · 04-26-2006, 09:04 AM

Quote:

Originally Posted by chupachups

I want one of those wind-up laptops for my hurricane supply kit

BannerDept · 04-26-2006, 09:19 AM

shut it down, they found you.

micker · 04-26-2006, 09:46 AM

Quote:

Originally Posted by chupachups

Anyone know? Some overflow shit?

193.X.X.X - - [25/Apr/2006:05:45:07 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04Hx04H\x04H\x04H\x0.... ....

Its a windows specific exploit, most likely of the buffer/stack/heap overflow variety. As long as you're not running a windows server you have nothing to worry about.

04-26-2006, 08:35 AM	#1
chupachups Confirmed User Join Date: Dec 2002 Location: Sweden/Spain you sum bitch! Posts: 6,576	Found this in my raw logs - wtf is it? Anyone know? Some overflow shit? 193.X.X.X - - [25/Apr/2006:05:45:07 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04Hx04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04Hx04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4Hx90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90x90\x 90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x 90\x90\x90\x90\x90\x90\x90" 414 333 "-" "-" __________________

04-26-2006, 08:37 AM	#2
chadglni Confirmed User Join Date: Dec 2002 Location: PEI, Canada Posts: 6,924	Mark of the beast. Turn it upside down and you'll see all the 6's. __________________ Sign up here - Dating Site affiliate program

04-26-2006, 08:48 AM	#7
zigx Confirmed User Join Date: Sep 2003 Location: Burlingame CA Posts: 1,430	the code is just encoded to hex __________________ _,.:'`- Club JK . com --> 60% payouts RSS, Hosteds, POTD, Your Mother, etc... CCBill

04-26-2006, 08:49 AM	#8
kursk Confirmed User Join Date: Nov 2005 Posts: 294	you've been hacked by Alkeida __________________ http://www.wickedworks.us Adult visual design with an artistic touch.

04-26-2006, 09:19 AM	#14
BannerDept Confirmed User Join Date: Apr 2006 Posts: 511	shut it down, they found you. __________________ ICQ: 106-293 Summer Design Specials!

04-26-2006, 08:41 AM	#4
mardigras Bon temps! Join Date: Feb 2003 Location: down yonder Posts: 14,194	Obviously a H4x0r

04-26-2006, 08:44 AM	#5
The Truth Hurts Zph7YXfjMhg Industry Role: Join Date: Nov 2002 Location: In Your Skull Posts: 15,306	RS_IIS.C exploit

04-26-2006, 08:45 AM	#6
tyler. Confirmed User Join Date: Mar 2006 Posts: 1,653	that is some freaky shit