Recently i found a script attack my web sites from many IPs , below is the small part of my log . you can check your raw access log or error log to see if you are under attack. i got about 1000~2000 attacks everyday from over 100 IPs. today i banned 200 IPs. :(
friends , do you have same problem like me . let's see how to solve it . i don't have admin folder , and i don't have banner_manager.php , but they still try to access , everyday .
===========================================
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /admin/banner_manager.php/
login.php HTTP/1.1" 403 1244 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 444 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/admin/banner_manager.php/login.php HTTP/1.1" 403 456 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/products_new.php?page=2/admin/banner_manager.php/login.php HTTP/1.1" 200 66745 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/products_new.php?page=2/admin/categories.php/login.php HTTP/1.1" 200 66796 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 446 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/admin/categories.php/login.php HTTP/1.1" 403 452 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/admin/file_manager.php/login.php HTTP/1.1" 403 454 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/products_new.php?page=2/admin/file_manager.php/login.php HTTP/1.1" 403 438 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
================================================
here is what i do ,
1.banned this ip by a script , auto filter , i use modified a addon http://addons.oscommerce.com/info/7509 to myself .
even i banned the IP , it still access my site so this should be a script attack , so ...
2,i got to find out who is the host owner , i use http://whois.domaintools.com/ and http://who.is/ , then i will got some owner email and host name , check their site, then try to write email to notify them . this is a funny job , it make me feel like i got told somebody ,
"Hei , your dog shit everywhere , could you please check it" lol
anyway my host company don't do this , they just complain my CUP usage too much , then tell me they will suspended my account , so i got do this by my self .....
some people will reply you , John Sinteur is a nice guy , he reply me friendly , welcome to visit his site
http://www.sinteur.com/ , his site is funny . he give me a solution of his . list below
=============================================
can you tell me how do you solve this ?
Check the full processlist on my server for weird processes ("ps aux")
Check the output of lsof (which is usually very long) and eleminate everythibg I know about, what's left is investigated.
Kill everything found.
That eliminates the outbound attacks, and it gives you hints which files are doing the bad things. This time I found them in /tmp
The user id that owns the files is an indication what process was hacked. In this case it ran as the webserver user.
I have only a few websites at that IP address, so I checked all the recently written or modified files and directories in those website where the website owner could write.
That way I found the enclosed file. I removed the write privilieges of the diectories and told the owner of the OSCommerce shop the directory belonged to that uploading images for products was disabled until the exploit that was used to penetrate OSCommerce was fixed.
Next, I checked the webserver log to see which IP addresses accessed those files and blacklisted those as well.
=============================================