""ET EXPLOIT Quanta LTE Router RDE Exploit Attempt 2 (traceroute)""
SID: 2022701
Revision: 1
Class Type: attempted-admin
Metadata: created_at 2016_04_05, updated_at 2016_04_05
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
-
Value: "POST"
-
Value: "/webpost.cgi"
-
Value: "|7b 22 43 66 67 54 79 70 65 22 3a 22 74 72 61 63 65 72 74 22 2c 22 63 6d 64 22 3a 22 74 72 61 63 65 72 74 22 2c 22 75 72 6c 22 3a 22|"
Within:
PCRE: "/^[^\x22]*[\x24\x60]+/Ri"
Special Options:
-
http_method
-
http_uri
-
fast_pattern