<story><title>ShellShock exploited in the wild: kernel exploit with CnC component</title><url>https://gist.github.com/anonymous/929d622f3b36b00c0be1</url></story><parent_chain></parent_chain><comment><author>crypt1d</author><text>Interesting.&lt;p&gt;I ran the &amp;quot;nginx&amp;quot; binary thru strace in a vagrant vm and got some connection attempts to a clouldflare IP&lt;p&gt;connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr(&amp;quot;108.162.197.26&amp;quot;)}, 16) = 0&lt;p&gt;but didn&amp;#x27;t see anything interesting being sent there... My tcpdump output showed it connects to a http server at 89.238.150.154:5 and exchanges some data there&lt;p&gt;sent &amp;gt;&amp;gt;&amp;gt; BUILD X86&lt;p&gt;recv &amp;gt;&amp;gt;&amp;gt; !* HTTP&lt;p&gt;recv &amp;gt;&amp;gt;&amp;gt; 190.93.240.15,190.93.241.15,141.101.112.16,190.93.243.15,190.93.242.15 pastebin.com &amp;#x2F;4HQ2w4AZ 80 2&lt;p&gt;recv &amp;gt;&amp;gt;&amp;gt; PING&lt;p&gt;sent &amp;gt;&amp;gt;&amp;gt; PONG&lt;p&gt;then it just goes to do ping&amp;#x2F;pong with the same server. At one point the process forks a separate process of itself and dies...&lt;p&gt;The pastebin link leads to an uploadcash.org file named hermoine_granger_jpg.jpg which I can assume is a payload of somekind...</text></comment>
<story><title>ShellShock exploited in the wild: kernel exploit with CnC component</title><url>https://gist.github.com/anonymous/929d622f3b36b00c0be1</url></story><parent_chain></parent_chain><comment><author>sagischwarz</author><text>Could someone explain to me if what I think this gist shows is correct?&lt;p&gt;A get request is sent to the server with additional commands added to the content, which creates the file .&amp;#x2F;tmp&amp;#x2F;besh whose content comes from the ngix file from &lt;a href=&quot;http://162.253.66.76/nginx&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;162.253.66.76&amp;#x2F;nginx&lt;/a&gt;. The executable flag is set and then the file gets executed.&lt;p&gt;The next three commands show information about the downloaded nginx file (check sums, file command info). For what reason? Is the file really an nginx server or is it just named like this to show that nginx is exploitable? I know that this is basically about the bash exploit, right?&lt;p&gt;Thanks</text></comment>