Never hurts to make sure
I’ve written about Papertrail a few times before, I love the service and it’s just too valuable to not use.
Papertrail makes it super easy to find Shellshock exploit attempts and probes. Probes are just checking a machine to see if it’s vulnerable to Shellshock. If you’re using CloudFlare, you’ll never see any Shellshock attempts show up in your logs, CloudFlare doesn’t even let them through.
See If Shellshock Affects You
Checking to see if your system is vulnerable to Shellshock is quite easy. It takes a relatively simple bash command:
env x='() { :;}; echo vulnerable to shellshock' bash -c "echo All good"
Run that code in a terminal. If you see All good, you’re not vulnerable. However, if you see vulnerable to shellshock, you are potentially vulnerable.
Shellshocker.net provides a script that will download, compile, and install the newest version of bash for you. You should only use it though if your Linux distribution hasn’t already provided updated security release packages. If you’re interested, the code that runs Shellshocker.net is available on GitHub.
Find Shellshock Attemps and Probes Via The Command Line
This is very easy as long as you know the location of your Apache access log file. It’s typically something like /var/log/apache2/access.log. Assuming that’s the location of your Apache access log file, this command will pull out all the Shellshock probes and attempts:
grep '() {' /var/log/apache2/access.log
If nothing was returned, that means nobody has been trying to exploit Shellshock on your system, or even checking to see if your system is susceptible to Shellshock. If results are returned, look them over carefully to examine where the attempts are coming from, an IP address will be associated with every attempt.
Shellshocker.net Checker
Shellshocker.net also provides a bash script to check your machines for the Shellshock vulnerability. You can download the script and run it manually from your terminal, or, if you have cURL installed, run the following command:
curl https://shellshocker.net/shellshock_test.sh | bash
Running that command will produce results similar to the screenshot seen below. It checks for a number of Shellshock related vulnerabilities.
Find Shellshock Attemps and Probes With Papertrail
Go to your Papertrail events tab and search for the following:
"() {"
If anything is returned, those are Shellshock probes. Some example probes are listed in the gist that’s embedded below. None of the offending IP addresses have been redacted.
These actually made it through to Papertrail, which shouldn’t happen since longren.io sits behind Cloudflare. I’ll open a support ticket with them about it and update this post later.
