Found this in my raw logs - wtf is it?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • chupachups
    Confirmed User
    • Dec 2002
    • 6576

    #1

    Found this in my raw logs - wtf is it?

    Anyone know? Some overflow shit?

    193.X.X.X - - [25/Apr/2006:05:45:07 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04Hx04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x 04H\x04H\x04Hx04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x0 4Hx90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x9 0\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90x90\x 90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x 90\x90\x90\x90\x90\x90\x90" 414 333 "-" "-"
  • chadglni
    Confirmed User
    • Dec 2002
    • 6924

    #2
    Mark of the beast. Turn it upside down and you'll see all the 6's.


    Sign up here - Dating Site affiliate program

    Comment

    • chupachups
      Confirmed User
      • Dec 2002
      • 6576

      #3
      Originally posted by chadglni
      Mark of the beast. Turn it upside down and you'll see all the 6's.
      So Eddie has been visiting me?

      Comment

      • mardigras
        Bon temps!
        • Feb 2003
        • 14194

        #4
        Obviously a H4x0r
        .

        Comment

        • The Truth Hurts
          Zph7YXfjMhg
          • Nov 2002
          • 15734

          #5
          RS_IIS.C exploit

          Comment

          • tyler.
            Confirmed User
            • Mar 2006
            • 1653

            #6
            that is some freaky shit

            Comment

            • zigx
              Confirmed User
              • Sep 2003
              • 1430

              #7
              the code is just encoded to hex
              _,.:'`- Club JK . com --> 60% payouts
              RSS, Hosteds, POTD, Your Mother, etc... CCBill

              Comment

              • kursk
                Confirmed User
                • Nov 2005
                • 294

                #8
                you've been hacked by Alkeida
                http://www.wickedworks.us
                Adult visual design with an artistic touch.

                Comment

                • mardigras
                  Bon temps!
                  • Feb 2003
                  • 14194

                  #9
                  Originally posted by The Truth Hurts
                  RS_IIS.C exploit
                  I just Googled that and a posting gave a similar log entry and some information about the exploit. Definitely something you want to get patched, chupachups
                  .

                  Comment

                  • chupachups
                    Confirmed User
                    • Dec 2002
                    • 6576

                    #10
                    Originally posted by mardigras
                    I just Googled that and a posting gave a similar log entry and some information about the exploit. Definitely something you want to get patched, chupachups

                    Thx guys - checking in now

                    Comment

                    • madawgz
                      8.8.8.8
                      • Mar 2006
                      • 30509

                      #11
                      Originally posted by kursk
                      you've been hacked by Alkeida
                      nah - they are too busy trying to destroy the world...do they have internet?
                      TAEMDLRMSKRJIXMRLSMRJ.

                      Comment

                      • chupachups
                        Confirmed User
                        • Dec 2002
                        • 6576

                        #12
                        Originally posted by madawgz
                        nah - they are too busy trying to destroy the world...do they have internet?

                        I suspect you are a racialist!!!



                        Comment

                        • mardigras
                          Bon temps!
                          • Feb 2003
                          • 14194

                          #13
                          Originally posted by chupachups
                          I want one of those wind-up laptops for my hurricane supply kit
                          .

                          Comment

                          • BannerDept
                            Confirmed User
                            • Apr 2006
                            • 511

                            #14
                            shut it down, they found you.

                            ICQ: 106-293
                            Summer Design Specials!

                            Comment

                            • micker
                              Confirmed User
                              • Nov 2005
                              • 748

                              #15
                              Originally posted by chupachups
                              Anyone know? Some overflow shit?

                              193.X.X.X - - [25/Apr/2006:05:45:07 -0400] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04Hx04H\x04H\x04H\x0.... ....
                              Its a windows specific exploit, most likely of the buffer/stack/heap overflow variety. As long as you're not running a windows server you have nothing to worry about.

                              Comment

                              Working...