↓ Skip to main content
bubka hacks stuff

Command Injection

LD-Whoami Command Detected in Request Body

SOC SIEM EDR Log Analysis Web Attack Command Injection RCE Escalation to L2 True Positive AbuseIPDB VirusTotal
An external attacker from a CHINANET-hosted IP (61.177.172.87) exploited a command injection vulnerability on WebServer1004, executing five OS commands via the ?c= parameter against /video/ - including cat /etc/passwd and cat /etc/shadow - all of which returned HTTP 200 with distinct response sizes, confirming successful remote code execution. The case was escalated to Tier 2.