Checkout ampliasecurity's exploit for the CVE-2014-6271 Bash Remote Code Execution Vulnerability against a simple #!/bin/bash CGI script running on Apache.
(CVE-2014-6271) Exploiting Bash Remote Code Execution Vulnerability
(CVE-2014-6271) Exploiting Bash Remote Code Execution Vulnerability
You can also read: Exploiting BASH Remote Code Execution Vulnerability (CVE-2014-6271)