> I see a return code of 200. Does that mean this script was executed? The return code is for GET request on /. Unless you have an index page that "executes" (typically cgi) referer or browser useragent. It seems as an bash vulnerabilty (known as shellshock CVE-2014-6271) attempt. rr