: Odd Apache Request "GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1" I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log

@Kimberly868

Posted in: #Apache #Security

I've been looking into an issue with my servers, and while looking I found this weird request in the Apache Access Log GET /shell?echo+jaws+123456;cat+/proc/cpuinfo HTTP/1.1.

This ended up returning a 404 but it took over 5 seconds for apache to send a response. What is their trying to do, when I tried to run this myself on my server to see what would happen my firewall/antivirus came up with the following blocking what my PC tried to send Web Attack MVPower DVR Shell Unauthenticated Command Execution.

I ended up disabling the firewall/antivirus so I could then send the request, but the request was done straight away.

So three question.


What could they have done different to what I did that made my server take > 5 seconds to response.
Is there anything they could have done to compromise the server, is there any other logs I can check to make sure that this is not the case.
What were they trying to do, it looks like their trying to read my CPU (number of cores/speed?) but I'm not sure why they would want to bother.


Thanks for any info you can provide.

Vote Up Vote Down

Login to post a comment!