What exploit is this?

Question

Our company site just went live and the very first entry in access.log looks like a tentative exploit :) Any idea on which one it could be?
Here's the relevant line:

79.168.7.121 - - [28/Jan/2011:13:19:25 +0100] "Z\xc0\xf5\x95\xb8Un\xff\x9ecA\xd1\xc2/\xfc\x94n\x8epeM\xdc\x18#\xb3\xc8\xa5\xbe)\xbci\xe2\xf5\x02,\x97\xc0\x96\x9e\xa9\xf8;i\x1a\x86\x01" 200 4855 "-" "-"

I wonder why someone downvoted the question.. ?_? – Joril Jan 28 '11 at 16:21 — Joril, Jan 28 '11 at 16:21

score 4 · Accepted Answer · answered Jan 29 '11 at 00:57

I don't mean to discount the validity of your question, but past a certain point, chasing this kind of log traffic just becomes prohibitively time-costly. Script kiddies, automated exploit-probing bots, badly-designed web spiders - they'll all come pay your web server a visit at some point, and they'll all leave bizarre entries in your access logs. What you need to consider, and develop a log analysis strategy to expose, is when access to privileged resources are granted in correlation with these weird lines; you should key your log analysis on finding unexpected privileged access, rather than unexpected requests. Consider how to link your web server access logs against your web application logs to get a better view of what actually constitutes unexpected access. I realize that's pretty general advice, but I hope it's somewhat useful.

score 1 · Answer 2 · answered Jan 28 '11 at 14:33

1

The IP address is from Lisboa, Portugal (as any GeoIP service can tell you). The "\x" escapes are escapes to specify Unicode codepoints, so they should resolve to something more or less meaningful.

But it seems the requests yielded a HTTP 200?

answered Jan 28 '11 at 14:33

Axel Knauf

1,600
1
10
12

Any idea @Axel what it is translating to? – Bart Silverstrim Jan 28 '11 at 14:52
I do not make anything useful of it (not being a security guy). Maybe control characters? http://unicodelookup.com/ – Axel Knauf Jan 28 '11 at 15:14
yes the server responded with the homepage.. Is it a problem? – Joril Jan 28 '11 at 16:19
1

@Joril: I do not think so. Jeff makes a good point in his answer that separating suspicious requests from the really relevant ones should be the main point in log analysis. You will see lots of these "noise" requests in your log in the long run. – Axel Knauf Jan 31 '11 at 12:48

score 0 · Answer 3 · answered Jan 28 '11 at 13:39

0

Could be a buffer overflow exploit.

answered Jan 28 '11 at 13:39

Sameer

4,070
2
16
11

Yes I thought it could be, but I was wondering if it was targeted at IIS, Apache or whatever :) – Joril Jan 28 '11 at 13:47

What exploit is this?

3 Answers3

Linked