Explanation
To extract private information, attackers are using a couple of techniques. The simplest extraction attacks are in the form:
() {:;}; /bin/cat /etc/passwd
That reads the password file /etc/passwd, and adds it to the response from the web server. So an attacker injecting this code through the Shellshock vulnerability would see the password file dumped out onto their screen as part of the web page returned.
References: https://blog.cloudflare.com/inside-shellshock/

The post-attack phase revolves around returning any modified system(s) to the pretest state. Examples of such activities:
References: Computer and Information Security Handbook, John R. Vacca (2012), page 531