August 08, 2010

Probing, probing...

Any idea what in hell this Chinese guy was looking for? It's evident that it's searching for some specific piece of server code, because that code has a vulnerability.

Whatever it was, he didn't find it here. But the pattern of files it was looking for is quite tantalizing.

Excerpt from my referer logs below the fold.

- -> /nosuichfile.php 211.100.49.195 0pct.
- -> /noxdir/nosuichfile.php 211.100.49.195 0pct.
- -> /PMA/scripts/setup.php 211.100.49.195 0pct.
- -> /PMA2005/scripts/setup.php 211.100.49.195 0pct.
- -> /admin/mysql/scripts/setup.php 211.100.49.195 0pct.
- -> /admin/phpmyadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /admin/pma/scripts/setup.php 211.100.49.195 0pct.
- -> /admin/scripts/setup.php 211.100.49.195 0pct.
- -> /db/scripts/setup.php 211.100.49.195 0pct.
- -> /dbadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /myadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /mysql-admin/scripts/setup.php 211.100.49.195 0pct.
- -> /mysql/scripts/setup.php 211.100.49.195 0pct.
- -> /mysqladmin/scripts/setup.php 211.100.49.195 0pct.
- -> /mysqlmanager/scripts/setup.php 211.100.49.195 0pct.
- -> /p/m/a/scripts/setup.php 211.100.49.195 0pct.
- -> /pHpMy/scripts/setup.php 211.100.49.195 0pct.
- -> /pHpMyAdMiN/scripts/setup.php 211.100.49.195 0pct.
- -> /php-my-admin/scripts/setup.php 211.100.49.195 0pct.
- -> /php-myadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyA/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmi/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.10.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.10/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.11.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.2.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.2.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.3.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.4.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.5-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.5-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.5-rc2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.6-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.6-rc2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.7-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.5.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-alpha/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-alpha2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-beta1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-beta2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-pl2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-pl3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-rc2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0-rc3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1-pl2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1-pl3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1-rc2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.2-beta1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.2-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.2-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.3-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.3-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4-pl2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4-pl3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4-pl4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.6.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.0-beta1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.0-pl1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.0-pl2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.0-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.7.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0-beta1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0-rc2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.0/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.1-rc1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.5/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.6/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.7/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.8/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.8.9/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.9.1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2.9.2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-3/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin-4/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin1/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAdmin2/scripts/setup.php 211.100.49.195 0pct.
- -> /phpMyAds/scripts/setup.php 211.100.49.195 0pct.
- -> /phpm/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmanager/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmy-admin/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmy/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmyad-sys/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmyad/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmyadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /phpmyadmin2/scripts/setup.php 211.100.49.195 0pct.
- -> /pma/scripts/setup.php 211.100.49.195 0pct.
- -> /pma2005/scripts/setup.php 211.100.49.195 0pct.
- -> /scripts/setup.php 211.100.49.195 0pct.
- -> /sqladmin/scripts/setup.php 211.100.49.195 0pct.
- -> /sqlmanager/scripts/setup.php 211.100.49.195 0pct.
- -> /sqlweb/scripts/setup.php 211.100.49.195 0pct.
- -> /vhcs2/tools/pma/scripts/setup.php 211.100.49.195 0pct.
- -> /web/phpMyAdmin/scripts/setup.php 211.100.49.195 0pct.
- -> /webadmin/scripts/setup.php 211.100.49.195 0pct.
- -> /webdb/scripts/setup.php 211.100.49.195 0pct.
- -> /websql/scripts/setup.php 211.100.49.195 0pct.

Posted by: Steven Den Beste in Site Stuff at 11:02 AM | Comments (1) | Add Comment
Post contains 889 words, total size 11 kb.

1 Looks like they're trying to exploit something in an old version of phpMyAdmin, a frontend administration tool for MySQL databases.  Nothing I'm familiar with, but they sure could wreak havoc once they get in...

Posted by: Mark at August 08, 2010 02:52 PM (1y5ce)

Hide Comments | Add Comment

Enclose all spoilers in spoiler tags:
      [spoiler]your spoiler here[/spoiler]
Spoilers which are not properly tagged will be ruthlessly deleted on sight.
Also, I hate unsolicited suggestions and advice. (Even when you think you're being funny.)

At Chizumatic, we take pride in being incomplete, incorrect, inconsistent, and unfair. We do all of them deliberately.

How to put links in your comment

Comments are disabled. Post is locked.
16kb generated in CPU 0.0076, elapsed 0.0137 seconds.
20 queries taking 0.0084 seconds, 18 records returned.
Powered by Minx 1.1.6c-pink.