Skip to main content

Attacks to autodiscover.cgi

Arvy
Hi there, I'm receiving some "attacks" to /cgi-sys/autodiscover.cgi I realized the attacks with high number of incoming and outgoing connections, and some cpu usage (not high). I found the logs, with hundreds of lines but the IP is 127.0.0.1... My question is: how can I monitor (fail2ban) the "real" connections, and detect the attacker IP? Thanks. [CODE=less]127.0.0.1 - - [16/Apr/2021:22:55:05 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:09 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:10 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:12 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:13 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:15 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:16 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:17 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:18 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:19 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:20 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:22 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:22 -0300] "HEAD /cgi-sys/autodiscover.cgi HTTP/1.1" 400 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.146 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:22 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:23 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:24 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:25 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:26 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:26 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:27 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:27 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:29 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:30 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:31 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:31 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:33 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:33 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:34 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:34 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:35 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:36 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:57 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:58 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:55:59 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:56:00 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:56:02 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:56:04 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 400 52 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36" 127.0.0.1 - - [16/Apr/2021:22:56:05 -0300] "GET /cgi-sys/autodiscover.cgi HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"

Comments

7 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! Can you let me know which logs you're seeing those entries in? Do you have any tools like Nginx running on the machine that may be hiding the real IP address?
    0
  • Arvy
    Hi @cPRex, these logs are from Apache "default" log file - /var/log/apache2/access_log No tools running, the server is 100% cPanel, no external tools. I think this is related to Apache "proxy" (maybe?), so I cannot detect the real attacker IP fo failt2ban it. Thanks.
    0
  • cPRex Jurassic Moderator
    That's very odd, as Apache doesn't have any type of proxy tools installed by default. Could you open a ticket with our team so we can check this?
    0
  • Arvy
    Maybe something related to websocket? I found in httpd.conf: RewriteCond %{HTTP_HOST} =autodiscover.example.com.br [OR] RewriteCond %{HTTP_HOST} =autodiscover.example.com.br:443 RewriteCond %{HTTP:Upgrade} !websocket [nocase] RewriteRule ^ http://127.0.0.1/cgi-sys/autodiscover.cgi [P] RewriteCond %{HTTP_HOST} =cpanel.example.com.br [OR] RewriteCond %{HTTP_HOST} =cpanel.example.com.br:443 RewriteCond %{HTTP:Upgrade} !websocket [nocase]
    0
  • cPRex Jurassic Moderator
    All cPanel servers have those entries to handle the various rewrites, but I wouldn't expect that to cause an issue.
    0
  • Arvy
    I think they are attacks on autodiscover.cgi in different domains, in the accounts, and the CGI logs them as localhost (due to the rewrite?). The problem is how to monitor and discover the attacker's IP. This is not critical, anyway, because is not affecting the servers performance.
    0
  • cPRex Jurassic Moderator
    I just checked on my personal server by doing to domain.com/cgi-sys/autodiscover.cgi and that does show me the correct IP address in the logs. I also tried autodiscover.domain.com, and that also logged the IP how I would expect. If you're not seeing that, you should put in a ticket so we can check the behavior on the server.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post