Just having a vulnerable bash isn't enough to break in. You also need something that uses it. A CGI script available via webserver, or some other service (I hear OpenVPN had issues...)