SEARCH - DOS Attack ?

[GivenRandy]

I have a bunch of the following in my logs (I trimmed it because it was 32k long). Is it a DOS attack or something else?

"SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\
...
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90" 414 341 "-" "-"

[jason]

Not a DOS attack...it looks like someone is trying to cause a buffer overrun. That's a situation where someone tries overload part of the server's memory, causing it to open a hole where they can do whatever they want with the system. These kinds of things can happen on any system, but these types of attacks are most common on Windows. In this case it is probably someone trying to exploit a hole in Window's Internet Information Server. These types of attacks are usually done en masse with a script that tries random IP addresses and/or domain names harvested from search engines or whatnot. More than likely it is nothing to worry about.

--Jason

[Vin DSL]

It's shellcode - an automated exploit probably. Just ignore it. It's JagPC's problem, not yours.

I'll point Tech Support to this thread...

[Vin DSL]

Never mind...

I looked it up on my favorite scumbag hacker hangout. That an old NT4 with DCOM exploit that's been revived. Actually, it's part of a reverse shellcode generator, but it only works remotely on W2K/XP, so JagPC is safe.

If you're tired of seeing it in your logs, ban the offending IP[s].

[GivenRandy]

Thanks!

[GivenRandy]

p.s., the IP address is constantly changing, probably by spoofing, so banning it may not be effective.

[requestcode]

I have also been getting the same thing now for over a week.

[Joshua Clinard]

I've been seeing that in my logs for more than a month now.