Yeah, I was aware of what the content was, and this shows up in my logs at least 3 times a day, with the same broke image.. I am wondering if it is some kind of stack overflow exploit or something.. decoding on my end also results in a broken png file. <br>
<br>Thanks... I always watch my logs, its actually part of my job :) Morning routine consists of looking through several logs before I even go get coffee :)<br><br>-Steve<br><br><br><div class="gmail_quote">On Thu, Jan 27, 2011 at 10:48 AM, Aaron Grattafiori <span dir="ltr"><<a href="mailto:aaron@digitalinfinity.net">aaron@digitalinfinity.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Steve,<br>
<br>
That base64 data simply seems to be an image (png) (as referenced by<br>
it's content type). URL Decoding it and then base64 decoding it<br>
does confirms this. It was broken when I tried to display it (although<br>
I might've broken something while trying to quickly decode it). The<br>
comment says "Created with GIMP".<br>
<br>
This seems like broken code somewhere.<br>
<br>
Good job being diligent on watching your logs though!<br>
<br>
-Aaron<br>
<div><div></div><div class="h5"><br>
On Thu, Jan 27, 2011 at 10:19 AM, Steve Johnson <<a href="mailto:srj@adnd.com">srj@adnd.com</a>> wrote:<br>
> Hi NBluggers,<br>
><br>
> I've been seeing an interesting entry in my logwatch reports for my apache<br>
> logs.. Its a GET statement with a big chunk of base64 code attached to it<br>
> with data:image/png as the type. I am going to assume it is some type of<br>
> exploit attempt, and since the logs show that apache is returning a 404<br>
> responses that they are not getting anywhere with it.. I'm wondering if<br>
> anyone has any details on this exploit, and what I can maybe do to stop them<br>
> from even trying.<br>
><br>
> Here's the log entry with the encoded GET statement:<br>
><br>
> GET<br>
> /pages/office-of-institutional-research/external-data-sources/url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADgAAAAOCAYAAAB6pd%2buAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A%2fwD%2foL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oGAhENK17O5ogAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAD6UlEQVRIx82WXWxTdRjGf6fndO3adbZ0VLoP9gFMXZQFNgSWDEkEYtSQkNVg4o2JH9NGJTMk6k01vTIhXshFzTCKE5NFORoXXDBs4nTMZHMzSETHDKyQyb7Xbu36dc7p8aaQZm5GNzd8rk7evOf%2fz%2fM%2bz%2f99X4E1htcn68v5742mffVRJd19uucqH539lSq3yKuHtlDmkPj99aPYe39kfRoMOqgCJHSdJNRL3AEE%2fB7h3xZFgO6JuRQdl6PE8zfRPzlF71CEojoXFc%2b9SPy3KxjCc%2bgCpIE0IilB65YWHFQBfAbUZEIDQGPA7xngDsNgMpFUY0Q0ESHHhKbkM3A9yoFqDceGQpTijWjhXxCAtC6gCWk0BAwLzqkAQsC6TJVDGcKrZdeDXp%2fcvki8zeuTH8uO6ehYzRJumxEUBUkyMa%2baUDWBVDLNnJJgNE9ixGZiOlckaQAVAWmBdTqBzqxQJ%2fD2KgrTCDzq9clywO%2fxZMi1AgcBBbhNPhyJ47TlsGuzjaHRSRRdoKq8AF3XOdvZw1BMQneUMl9iZN4eo3AmRWVwFulvqusAngBOryLBY0AcaPD65LeAFPAk0BLwe57OTnz3i4sc3ruFx2s24MwzoWgaW4tNnPn0JLt37KJ2zwGMgk5X3zd8ONJOX7mGvcK5OEGvT94HNGcs2rj!<br>
> SzrhUUwn4PV1AV4bcm5nwkYDfc3xhbs%2bVWQZH%2btlekc%2fDtRupKrub1uYT7NhWw9bde%2fl2REUSRR56pJT0lxofhM8xaheXVPA1oDPg9zT%2bExmsDqF8hUqmlvi%2bDUs6RWhW5Ov%2bKaxmK5XFLkIzIe7f%2fiBtwypPVZqIRWJ8Ny6x09OEJJs5rrTxn4yJY00NwRU0mtaMLY9kyL3n9clVAb%2fnley8wnyBkkIHrgILm925JGPTJONRDHqaHDQmx2a4Ph4hpFkpcZqZmBhHtbI4wYDfs3%2bNhn5bpqG03LKl1ydXAS97fXJ%2b9jv0Hq6lyK5C%2fBJ6PEjyj2nW2VQGLw5gLKqn92YSxWgjbrRy89ogVosFoyT%2bZUzcurjD65M71oDjCeDzbCIZ5VqAk9mJm9w5zAdPkRx%2bB3H6Y3Kj7TxQMkzLqfe5V71GvttFiduOa3aQc58E6JseJJXSEVhjeH2yvpxN5qVnygj%2fdJQCWxjBAOm0gVRC5MLPdoZnt2F3rsdisTAV7MBlusT3oVK6TOriCv4fIZnsSDlu1IQRNWVGV83kYKFuZzX7PQ1MFOg0j53nh%2bg8qpLg2eogeyJ53JFddDkLtyiZ6%2b%2b674Vu5cZXiIkJdAEMjnvIqzjEjVCS7rmrhOwC0Vwn58fqkIIXeL72Mn8CJn6UfKGeNt4AAAAASUVORK5CYII%3d)<br>
> HTTP/1.1 with response code(s) 404 1 responses<br>
><br>
><br>
> So, what do you guys think?<br>
><br>
> -Steve<br>
><br>
><br>
</div></div>> _______________________________________________<br>
> talk mailing list<br>
> <a href="mailto:talk@nblug.org">talk@nblug.org</a><br>
> <a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
><br>
><br>
<br>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
</blockquote></div><br>