Greetings everyone: Yesterday I had this show up in my logs:
** Alert 1240526101.2884130: mail - web,accesslog,attack, 2009 Apr 23 15:35:01 server->/var/log/lighttpd/access.log Rule: 31106 (level 12) -> 'A web attack returned code 200 (success).' Src IP: 10.1.0.24 User: (none) 10.1.0.24 10.1.0.1 - [23/Apr/2009:15:35:01 -0700] "GET /archive/ References/Temperature%20-%20Cold/Photoluminescence%20in%20lightly% 20doped%20epitaxial%20GaAs-Cd%20and%20GaAs-Si.pdf HTTP/1.1" 200 131072 "https://10.1.0.1/cgi-bin/search.cgi?q=Photoluminescence+in +lightly+doped+epitaxial+GaAs%3ACd+and+GaAs%3ASi&cmd=Search" "Mozilla/ 5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9 (.NET CLR 3.5.30729)" ** Alert 1240526463.2884786: - web,accesslog,attack, 2009 Apr 23 15:41:03 server->/var/log/lighttpd/access.log Rule: 31104 (level 6) -> 'Common web attack.' Src IP: 10.1.0.24 User: (none) 10.1.0.24 10.1.0.1 - [23/Apr/2009:15:35:01 -0700] "GET /archive/ References/Temperature%20-%20Cold/Photoluminescence%20in%20lightly% 20doped%20epitaxial%20GaAs-Cd%20and%20GaAs-Si.pdf HTTP/1.1" 206 4315 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9 (.NET CLR 3.5.30729)" The result was a user getting locked out of their files. Rule 31104 has this line: <url>/x90/|default.ida|/sumthin|nsiislog.dll|chmod%|wget%|cd%|</url> The rule appears to have been fired by ossec picking up the instances of Cd% in the filename and matching them to the cd% in the rule. I'm a little puzzled why this happened: I was under the impression that ossec's matching was case sensitive but this appears to show this assumption is incorrect. Also, I don't remember any instances of events like this in 1.6: things like this seem to only have started happening since 2.0 but maybe my memory isn't correct. --cryogen
