2

So I was debugging my code when I see these few lines in my log:

GET /cgi/common.cgi 302 8.015 ms - 23
GET /stssys.htm 302 2.928 ms - 23
GET / 200 134.922 ms - 9896
POST /command.php 302 33.826 ms - 23
GET /language/Swedish${IFS}&&echo${IFS}610cker>qt&&tar${IFS}/string.js 302 1.049 ms - 23

Could this affect me or my system? What can I do to protect against this? I'm not using CGI or PHP.

6

It's an attempt at command injection. IFS is basically a space in this situation, and && executes multiple commands. So you have:

/language/Swedish && echo 610cker > qt && tar /string.js

Which tries to execute three commands:

/language/Swedish   <-- where the injection takes place
echo 610cker > qt   <-- write 610cker to file qt
tar /string.js      <-- compress file string.js (but the command is invalid)

The commands do not really make sense and are not used to exploit your system, but likely used to test if it is vulnerable.

If you google 610cker you will find some reports about an exploit on a D-Link router (although the payload looks slightly different) and other systems (see eg here, using the same payload).

As with all log entries of this type, it is almost certainly a scanner. If your system is not vulnerable and there are no other signs of intrusion, I wouldn't worry about it.

| improve this answer | |
  • Wish I could upvote your answer more than once – Purefan Feb 9 '17 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.