I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1.

This ended up returning a 404 but it took over 5 seconds for apache to send a response. What is their trying to do, when I tried to run this myself on my server to see what would happen my firewall/antivirus came up with the following blocking what my PC tried to send Web Attack MVPower DVR Shell Unauthenticated Command Execution.

I ended up disabling the firewall/antivirus so I could then send the request, but the request was done straight away.

So three question.

  1. What could they have done different to what I did that made my server take > 5 seconds to response.
  2. Is there anything they could have done to compromise the server, is there any other logs I can check to make sure that this is not the case.
  3. What were they trying to do, it looks like their trying to read my CPU (number of cores/speed?) but I'm not sure why they would want to bother.

Thanks for any info you can provide.

  • 1
    This looks like a vulnerability test trying to see if shell access was possible. – closetnoc Oct 23 '17 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.