2

Can anyone let me know the steps to setup a simple Hello World Apache (or other GNU/Linux) website that i can hit over 80 or 443 and exploit any bash CVE vuln; assuming I have a vulnerable bash.

I dont have ssh creds to 100% of the boxes, and the bash (rpm) tests only work with credentialed scans.

I want to hit the URL, scan without any creds and see a positive finding from Nessus. Then patch bash and see that my URL is clean again.

But I need help building a little web site please. Thanks!

4

Stick the following script in your webserver's /cgi-bin/ directory and chmod it a+x:

#!/bin/bash

echo "Content-Type: text/plain"
echo ""
echo "Bash is here"

Note that this explicitly invokes bash, so systems with an unpatched bash will show as vulnerable even if the system shell is something else.

  • So that is it thanks! Odd thing tho. I am using Netsparker with only Checks for Shellshock turned on. If I crawl http://site Netsparker does not find it. If I crawl http://site/cgi-bin/shokka i get a big red positive. shokka is simply the text you laid out above. Now I am tweaking Netsparker trying to figure out why it does not find /cgi-bin/shokka on its own. Thanks at least i have seen a positive now. – Tom Chota Sep 28 '14 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.