Some sort of injection attack? ex: '@^Y@.@os~vq2,(/2os~vq@-1'+@lvo.(,1-+*1)+1+/@.(&

T

Theory5

n00b
Joined
May 30, 2012
Messages
6
So we are investigating a rather weird incident. We have someone who appears to be attempting to crash our internet facing servers (running luminus). We have several weird failed username attempts, some with valid data (but wrong syntax) and some with what appears to be gibberish.
look:

4 '@^Y@.@~q|wpmymzz2,&,2|pq{jvk@-1',@lvo.(,1-+*1)+1./.@+)*'
6 '@^Y@)@{vlk2++(2lvszqk@-1'+@lvo.(,1-+*1)+1))@&&/'
8 '@^Y@.@os~vq2,(/2os~vq@-1'+@lvo.(,1-+*1)+1+/@.(&'
9 '@^Y@.@{vlk2++(2lvszqk@-1',@lvo.(,1-+*1)+1./+@+)*'
9 '@^Y@.@{vlk2++(2lvszqk@-1',@lvo.(,1-+*1)+1(,@./*'
9 '@^Y@.@{vlk2++(2lvszqk@-1'+@lvo.(,1-+*1)+1..(@./*'
9 '@^Y@.@{vlk2++(2lvszqk@-1'+@lvo.(,1-+*1)+1.'(@&&/'
10 '@^Y@.@{vlk2++(2lvszqk@-1',@lvo.(,1-+*1)+1./(@+)*'
11 '@^Y@.@o()2,,*2|pq{jvk@-1',@lvo.(,1-+*1)+1((@./*'
11 '@^Y@.@os~vq2+(-2lvszqk@-1'+@lvo.(,1-+*1)+1./+@.(&'
12 '@^Y@.@{vlk2++(2lvszqk@-1'+@lvo.(,1-+*1)+1.),@.(&'
16 '@^Y@.@os~vq2,(/2os~vq@-1'+@lvo.(,1-+*1)+1.,)@./*'
17'@^Y@.@{vlk2++(2lvszqk@-1',@lvo.(,1-+*1)+1.*.@&&/
18 '@^Y@.@o()2,,*2|pq{jvk@-1'+@lvo.(,1-+*1)+1)'@+)*'
20 '@^Y@.@o()2,,*2|pq{jvk@-1'+@lvo.(,1-+*1)+1.,*@.(&'


A normal login on our site consists of 3 number and 3 letters (like CAB123, not a valid username, but valid syntax) or if they a new their "j number" which is an id number that starts off with J like J12345678

I thought it may be injection, as another site suggested it was SQL injection, but then someone else claimed that it did not have any valid PHP or SQL syntax.

If you want to see this structure, take a string and throw it into google, you will find analytics pages that show that this attack has been attempted again and again.

See:
https://www.google.com/search?q=%40^Y%40%29%40{vlk2%2B%2B%282lvszqk%40-1%27%2B%40lvo.%28%2C1-%2B*1%29%2B1%29%29%40%26%26%2F&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:eek:fficial&client=firefox-a


Any help would be appreciated!
 
Looks like more a bruteforce / injection. But the .(,1-+*1)+1 looks like a SQL injection pattern.
 
Last edited:
Metraon said:
Looks like more a bruteforce than injection. But the .(,1-+*1)+1 looks like a SQL injection pattern.
Click to expand...

Hey, Thanks for replying! Yea, it might be a brute force attack, I am waiting on the web team to pull the server logs. I forgot to mention, the numbers at the beginning of each line signifies the number of login attempts. We also have one more login that does this "Marley\abc123" (abc123 is the placeholder for the actual user account)

This is once again not valid, but the abc123 matched up with a specific user we have. in the last 14 days they have attempted to log in roughly 3100 times. It was originally assumed that "marley" was the password, but that didn't work. Might have been a previous password, but I'm not so sure.
 
Is this coming from one IP address or are they random IP addresses? If it's one, then you can whois the ip and report it to the owner of the IP range.
 
Mister Natural said:
Is this coming from one IP address or are they random IP addresses? If it's one, then you can whois the ip and report it to the owner of the IP range.
Click to expand...

This will be determined when we get the logs. still waiting... :-/

Metraon, that looks similar, but not the same structure.

Both of you, thanks for your help!
 
You must log in or register to reply here.
Back
Top