Key Observations

• ${IFS} bypasses space filtering
• whoami attempts to retrieve system identity
• curl attempts outbound communication

This is a command injection payload

Web Server Evidence

Nginx logs confirm the request reached the server:

POST /global-protect/login.esp
HTTP 200
User-Agent: curl

The malicious request was accepted and processed.

Internal Processing

System logs show the payload reached internal logic:

Key Finding

• payload was embedded into internal command (dt_curl)
• outbound request attempted
• execution chain reached internal components

However:

DNS lookup failed → outbound failed

Attacker Infrastructure

The attacking IP:

• 144.172.79.92
• flagged as malicious
• associated with hosting provider

This confirms external attacker origin.

Network Timeline

Multiple IPs interacted with the system before the attack:

Only 144.172.79.92 is directly tied to the exploit.

Impact Assessment

Confirmed

• exploitation attempt targeting CVE-2024-3400
• malicious payload delivered
• request processed by server
• payload reached internal processing
• outbound attempt triggered

Not Confirmed

• OS command execution
• command output
• data exfiltration
• reverse shell
• persistence
• lateral movement

Conclusion

This was a real command injection attempt.

The attacker successfully:

• delivered a malicious request
• injected a payload
• triggered internal processing

However:

there is no confirmed execution or system compromise

Final Classification

Command Injection Attempt
Payload Processed - No Confirmed Execution or Impact