Can anyone tell me what someone is trying to do with the following code in their user-agent:

() { :; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @

I have a script that tells me when someone has this or similar in their user-agent - a more dastardly-looking string with () { :; }; in it gets the user blocked from my server


  • 3
    Looks like a straightforward attempt to exploit Shellshock, dumping back at them some test output and the result of /bin/uname -a. – Tom Hunt Sep 4 '15 at 21:16

They are trying to exploit Shellshock. If the path they tried (they will usually attempt to guess cgi paths) happened to be vulnerable, the output would contain your uname.

The rest (the text/plain content-type, the M1337H first line and @ final one) are mainly cosmetic touches for the output. Providing "Content-type:text/plain" will ensure the web server doesn't eat it, and that the uname needs to be inbetween M1337H and @ is probably done to filter out the case where a legitimate non-vulnerable cgi does include the machine uname.

  • I wonder, then, if I do a yum update, will it be patched? or maybe it is already? I don't know. How would I know if the server was compromised? Thank you for your response. – richardwhitney Sep 5 '15 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.