2

Can anyone let me know the steps to setup a simple Hello World Apache (or other GNU/Linux) website that i can hit over 80 or 443 and exploit any bash CVE vuln; assuming I have a vulnerable bash.

I dont have ssh creds to 100% of the boxes, and the bash (rpm) tests only work with credentialed scans.

I want to hit the URL, scan without any creds and see a positive finding from Nessus. Then patch bash and see that my URL is clean again.

But I need help building a little web site please. Thanks!

1 Answer 1

4

Stick the following script in your webserver's /cgi-bin/ directory and chmod it a+x:

#!/bin/bash

echo "Content-Type: text/plain"
echo ""
echo "Bash is here"

Note that this explicitly invokes bash, so systems with an unpatched bash will show as vulnerable even if the system shell is something else.

1
  • So that is it thanks! Odd thing tho. I am using Netsparker with only Checks for Shellshock turned on. If I crawl http://site Netsparker does not find it. If I crawl http://site/cgi-bin/shokka i get a big red positive. shokka is simply the text you laid out above. Now I am tweaking Netsparker trying to figure out why it does not find /cgi-bin/shokka on its own. Thanks at least i have seen a positive now.
    – Tom Chota
    Commented Sep 28, 2014 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .