2

Can anyone let me know the steps to setup a simple Hello World Apache (or other GNU/Linux) website that i can hit over 80 or 443 and exploit any bash CVE vuln; assuming I have a vulnerable bash.

I dont have ssh creds to 100% of the boxes, and the bash (rpm) tests only work with credentialed scans.

I want to hit the URL, scan without any creds and see a positive finding from Nessus. Then patch bash and see that my URL is clean again.

But I need help building a little web site please. Thanks!

Improve this question

1 Answer 1

Reset to default
4

Stick the following script in your webserver's /cgi-bin/ directory and chmod it a+x:

#!/bin/bash

echo "Content-Type: text/plain"
echo ""
echo "Bash is here"

Note that this explicitly invokes bash, so systems with an unpatched bash will show as vulnerable even if the system shell is something else.

Improve this answer
1
  • So that is it thanks! Odd thing tho. I am using Netsparker with only Checks for Shellshock turned on. If I crawl http://site Netsparker does not find it. If I crawl http://site/cgi-bin/shokka i get a big red positive. shokka is simply the text you laid out above. Now I am tweaking Netsparker trying to figure out why it does not find /cgi-bin/shokka on its own. Thanks at least i have seen a positive now.
    – Tom Chota
    Sep 28, 2014 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .