156
A very simple example would be a cgi, /var/www/cgi-bin/test.cgi:
#!/bin/bash
echo "Content-type: text/plain"
echo
echo
echo "Hi"
Then call it with wget to swap out the User Agent string. E.g. this will show the contents of /etc/passwd:
wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://10.248.2.15/cgi-bin/...
123
Based on link from DarkLighting, here's the command I came up with using nested subshells.
openssl req -new -sha256 \
-key domain.key \
-subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \
-reqexts SAN \
-config <(cat /etc/ssl/openssl.cnf \
<(printf "\n[SAN]\nsubjectAltName=DNS:example.com,DNS:www.example.com")) \
-out domain....
122
Is my bash vulnerable?
This simple command is a sufficient test to see if your version of bash is vulnerable:
x='() { :;}; echo VULNERABLE' bash -c :
It's not necessary to have extra text printed to signify that the command has actually run, because patched versions of bash will report a warning when a variable in its starting environment contains exploit ...
99
With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb:
() { :; }; :(){ :|: & };:
Just put that in a user agent string on a browser, go to your web page, and instant DoS on your web server.
Or, somebody could use your server as an attack bot:
() { :; }; ping -s 1000000 <victim IP>
Put ...
60
You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.
59
As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit).
The commit adds an example to the openssl req man page:
Example of giving the most common attributes (subject and extensions)
on the command line:
openssl req -new -subj "/C=GB/CN=foo" \
...
52
This is probably an issue with the co-existance' of multiple realtime AV software. One will suspect the other one's activities as malicious.
Avast is trying to scan your router/default gateway and Norton flags it as malicious here. You should uninstall any of the two as soon as possible.
Running multiple AV's on the machine can have effects like low ...
47
Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like:
This code requires the output to be printed onto a specific terminal emulator
In fact, yes. Old terminals like vt100 have the ability to use ANSI escape sequences to do ...
44
Assume there is a (probably unintentional) backdoor.
The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this:
games::0:0:games:/nopath:/bin/false
In other words, an account named 'games' with no password. Apparently the genius who came up with this idea had no imagination, and assigned it a uid and gid of zero ...
43
My solution was to pass subjectAltName via an environment variable.
First have this added to openssl.conf:
[ san_env ]
subjectAltName=${ENV::SAN}
Then set the environment variable before invoking openssl:
export SAN=DNS:value1,DNS:value2
openssl req -extensions san_env -subj '/CN=value1' ...
Note: the -extensions san_env parameter needs to be present ...
39
.sh files are shell scripts. They are analogous to .bat files (cmd scripts) under Windows. All of these (shell scripts, cmd scripts, .exe Windows executables, Linux executables (which usually have no extension)) are executable programs; if you run one, it can do anything you can do. So yes, shell scripts can be harmful. Treat a shell script (or a Perl script,...
answered Jun 2 '12 at 22:06
Gilles 'SO- stop being evil'
43.3k13 gold badges103 silver badges157 bronze badges
36
This is targeting the Shellshock bug (which even has its own tag):
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi ...
35
Define "risk".
The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program.
Any method of triggering Bash execution ...
34
This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me):
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=Acme Root CA" -out ca.crt
openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/C=CN/ST=GD/L=SZ/O=...
33
CVE-2014-6271
CVE-2014-6271 was the first vulnerability discovered. A patch can be found here.
From Wikipedia:
Function definitions are exported by encoding them within the
environment variable list as variables whose values begin with
parentheses ("()") followed by a function definition. The new instance
of Bash, upon starting, scans its ...
30
A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow vulnerability that can be exploited for privilege escalation) or an administrator sets the SUID bit on a binary that should not have it set. An extreme example of ...
28
Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -c" to provide various features like shell redirection, pipelines or even just argument expansion when invoking processes.
Apache uses exactly this (via APR, ...
27
You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and inconsistencies on the login shell to escape.
One thing you could do is to escape to a shell using any option on the menu. If the menu lets you start vim, less,...
24
I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, because there is no escalation of privilege (i.e. you can only hack yourself).
We're definitely actively looking for scenarios where that is not the case, and ...
19
To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include:
Debian's dash
OpenBSD's ksh
Busybox ash
MirBSD/MirOS mksh
...and certainly others
Mark's answer suggests that at least OpenBSD's has received security scrutiny ...
answered Sep 27 '14 at 14:24
R.. GitHub STOP HELPING ICE
5,8111 gold badge17 silver badges24 bronze badges
15
I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more features a built-in text editor (in this particular case it was vi), it was enough to resize the terminal window from which you were connecting so that more is ...
14
The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example:
$ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-script
If a 5XX server error is generated, it means that the server is probably vulnerable to an exploit. For possible attack scenarios, please refer to this ...
14
This is an entry from my access_log of what my coworker did to my test machine... :
10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/rm -rf /var/www/"
In my error log I saw a lot of this:
[Thu Sep 25 16:00:00 2014] [error] [client 10.11.12.13] /...
13
It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet can send malformed DHCP responses and get root privileges.
Given the widespread use of environment variables to share state between processes in Unix and the ...
12
You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's only a matter of time before some shell gets executed (maybe unknown to you) with an environment it was not prepared for.
Every program (bash, java, tcl, php, .....
12
You can check if you're vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words "busted", then you're at risk. If only the second command prints “busted”, then your bash is vulnerable, but the vulnerability only impacts the parts of your system that invoke bash explicitly, not the parts that ...
12
In theory, yes. But then you also have problems with
LD_PRELOAD
LD_LIBARAY
BASH_ENV
etc.
The biggest problem with shellshock is that the name of the environment variable does not matter, bash would execute code in it even if you never call e.g. HTTP_COOKIES (who would do that btw?)
The attacker usually can only choose a part of the variable name, and it ...
12
It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems would be considered secure.
Given the architectural differences between them, Linux and Windows are incommensurable abstract constructs in the context of ...
11
If you need a method to check several servers at once that are on the same subnet, you can use Masscan to send a request to all of them: https://github.com/robertdavidgraham/masscan
An example configuration file can be found at http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html:
target = 0.0.0.0/0 //CHANGE THIS TO THE PROPER SUBNET
...
11
What you'd need to do is determine which processes are running bash. On Linux systems, one vulnerability seems to possibly be in how DHCP requests are handled.
You could look at using execsnoop to spot what runs bash and then try doing some normal things - like connecting to a wifi network or browsing webpages that require external helpers (say something ...
Only top voted, non community-wiki answers of a minimum length are eligible
