Someone tried to exploit the Shellshock vulnerability in Bash on lodash.com, likely as part of a mass-exploit attempt.
In this case, the exploit attempted to download a modified version of @schierlm’s pseudo-terminal Perl script that would connect to 72.167.37.182 on port 23. The download URL contains the targeted host name (?h=lodash.com) which gives the attacker an indication of which hosts might have the /tmp/a.pl backdoor in place.
| [\x80-\uD7FF\uDC00-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF] |
| var $sound = $('<div id="sound" />').appendTo('body'); | |
| $('#special-links-that-play-annoying-sounds-when-hovered a').hover(function() { | |
| $sound.html('<embed src="foo.mp3" hidden="true" autostart="true" loop="false">'); | |
| }, function() { | |
| // We could empty the innerHTML of $sound here, but that would only slow things down. | |
| }); |
| if(document.all&&!window.XMLHttpRequest){(function(){var b=1,a=0,e,c;function d(){if(b==2){b=0}if(!b++){e=c=0;a=~~(Math.random()*10000)+2000;setTimeout(d,a)}else{e=~~(Math.random()*2)+2;c=~~(Math.random()*360);setTimeout(d,500)}document.body.style.filter="progid:DXImageTransform.Microsoft.MotionBlur(strength="+e+",direction="+c+",enabled='true')"}setTimeout(d,1000)})()} |
| // This works when used from the console with the Reader document open, but fails when used as a bookmarklet. Any ideas? | |
| // See http://mathiasbynens.be/notes/safari-reader-html | |
| javascript:(function(d){var s=d.createElement('style');s.appendChild(d.createTextNode('#background{background:#f773b5 url(http://i.imgur.com/bB7aD.jpg)}h1.title,.page{font-family:"Comic Sans MS"!important}h1.title{color:#f773b5}.page{background:rgba(255,255,255,.9);-webkit-animation-name:f;-webkit-animation-duration:5s;-webkit-animation-iteration-count:infinite;-webkit-animation-timing-function:linear}@-webkit-keyframes f{0%{-webkit-transform:rotate(0) scale(1)}25%{-webkit-transform:rotate(-4deg) scale(.95)}50%{-webkit-transform:rotate(0) scale(1)}75%{-webkit-transform:rotate(4deg) scale(.95)}100%{-webkit-transform:rotate(0) scale(1)}}'));d.head.appendChild(s)})(document) |
| // Provides a device_scale class on iOS devices for scaling user | |
| // interface elements relative to the current zoom factor. | |
| // | |
| // http://37signals.com/svn/posts/2407-device-scale-user-interface-elements-in-ios-mobile-safari | |
| // Copyright (c) 2010 37signals. | |
| // Slightly optimized by Mathias Bynens <http://mathiasbynens.be/> | |
| // | |
| // Permission is hereby granted, free of charge, to any person obtaining a copy | |
| // of this software and associated documentation files (the "Software"), to deal | |
| // in the Software without restriction, including without limitation the rights |
| /* | |
| Usages: | |
| $(selector).classList() // returns an array of classnames | |
| $(selector).classList('newclass') // replaces the current element’s classes | |
| $(selector).classList(['new', 'class', 'names']) // replaces the current element’s classes | |
| */ | |
| jQuery.fn.extend({ | |
| classList: function(value) { | |
| if (value) { |
| jQuery.fn.toggleFade = function(speed, callback) { | |
| speed = ~~speed || 400; | |
| callback = callback || jQuery.noop; | |
| return this.each(function() { | |
| var $this = jQuery(this); | |
| $this[$this.is(':hidden') ? 'fadeIn' : 'fadeOut'](speed, callback); | |
| }); | |
| }; |
| Author: Mathias Bynens <http://mathiasbynens.be/> | |
| This code is licensed under the WTFPL. Feel free to relicense as needed. |