I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log
GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1.
This ended up returning a 404 but it took over 5 seconds for apache to send a response. What is their trying to do, when I tried to run this myself on my server to see what would happen my firewall/antivirus came up with the following blocking what my PC tried to send
Web Attack MVPower DVR Shell Unauthenticated Command Execution.
I ended up disabling the firewall/antivirus so I could then send the request, but the request was done straight away.
So three question.
- What could they have done different to what I did that made my server take > 5 seconds to response.
- Is there anything they could have done to compromise the server, is there any other logs I can check to make sure that this is not the case.
- What were they trying to do, it looks like their trying to read my CPU (number of cores/speed?) but I'm not sure why they would want to bother.
Thanks for any info you can provide.