I was looking at a sample capture from a tutorial I was looking at and below is a snippet of a wireshark packet capture:
OpenVAS:() { _; OpenVAS; } >_[$($())] { echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; id; }
My understanding of the above is that the malicious individual is using OpenVAS to scan for vulnerabilities. Using openvas, he then defines what paths he wants to export using PATH=/usr/bin:/usr/local/bin:/bin
. He then exports using export PATH
. Not sure what 'id' is.
Can someone assist in clarifying what exactly is going on? I think I'm on the right path but need help.