1

I'm using amazon linux on an m3.large instance on EC2. I had these logs before my apache server was shut down:

[Sun Sep 28 18:54:31.679261 2014] [cgi:error] [pid 32422] [client 67.211.230.58:58937] 
      script not  found or unable to stat: /var/www/cgi-bin/wlogin.cgi

[Mon Sep 29 03:32:17.602213 2014] [cgi:error] [pid 13612] [client 173.45.100.18:42591] 
      attempt to invoke directory as script: /var/www/cgi-bin/

[Mon Sep 29 03:32:19.142561 2014] [cgi:error] [pid 13623] [client 173.45.100.18:43455] 
      script not found or unable to stat: /var/www/cgi-bin/hi

[Mon Sep 29 15:40:45.599504 2014] [core:error] [pid 17852] [client 80.82.64.145:51226] 
      AH00126: Invalid URI in request GET  HTTP/1.1

[Mon Sep 29 22:53:46.532859 2014] [mpm_prefork:notice] [pid 10800]
      AH00169: caught SIGTERM, shutting down

And.. that's it. My httpd service was shut down.

What I'm smelling here is that some people are trying to access the server by executing CGI scripts with GET request which I found to suspect in this line:

script not found or unable to stat: /var/www/cgi-bin/hi

Here what the hell the "hi" supposed to mean unless it's not an exploiting attempt?

Also:

attempt to invoke directory as script: /var/www/cgi-bin/

They all are coming from thge same ip, 173.45.100.18.

Am I under DDoS and other malicious attack, or something arcane going on?

Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
edam
  • 111
  • 1
  • 3
  • Maybe, an attempt to exploit shellshock bash bug: http://security.stackexchange.com/questions/68122/what-is-a-specific-example-of-how-the-shellshock-bash-bug-could-be-exploited – dsmsk80 Sep 30 '14 at 07:33
  • @dsmsk80 Thanks for the link. I'm checking that out. – edam Sep 30 '14 at 08:51
  • The `SIGTERM` happened a number of hours after, so I doubt that's the cause. Do you have any cron scripts that could be reloading Apache or things of that sort? – Nathan C Sep 30 '14 at 12:57
  • 1
    Have you checked other logs like syslog or dmesg? Sometimes this can be the Linux OOM killer (out of memory killer). I'd setup something like atop (http://www.atoptool.nl/) which will let you log process information (including memory usage) so you can go back to a snapshot around that time to see what was going on in the system. – Andy Shinn Sep 30 '14 at 15:25

0 Answers0