Hot answers tagged

176 votes
Accepted

Provide subjectAltName to openssl directly on the command line

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit). The commit adds an example to ...
  • 1,876
159 votes
Accepted

What is a specific example of how the Shellshock Bash bug could be exploited?

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this ...
  • 7,535
151 votes

Provide subjectAltName to openssl directly on the command line

Based on link from DarkLighting, here's the command I came up with using nested subshells. openssl req -new -sha256 \ -key domain.key \ -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \ -...
  • 1,611
125 votes
Accepted

Is there a short command to test if my server is secure against the shellshock bash bug?

Is my bash vulnerable? This simple command is a sufficient test to see if your version of bash is vulnerable: x='() { :;}; echo VULNERABLE' bash -c : It's not necessary to have extra text printed ...
  • 1,315
100 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go ...
59 votes

Hacked Ubuntu server, probably hacked commands (netstat, ps, ...), how to replace them?

You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.
  • 15.4k
59 votes

Provide subjectAltName to openssl directly on the command line

This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me): openssl genrsa -out ca.key 2048 openssl req -new -x509 -days 365 ...
  • 691
53 votes

Avast performing an attack?

This is probably an issue with the co-existance' of multiple realtime AV software. One will suspect the other one's activities as malicious. Avast is trying to scan your router/default gateway and ...
  • 856
49 votes

Provide subjectAltName to openssl directly on the command line

My solution was to pass subjectAltName via an environment variable. First have this added to openssl.conf: [ san_env ] subjectAltName=${ENV::SAN} Then set the environment variable before invoking ...
  • 751
47 votes

Bypassing the command/script specified in /etc/passwd

Assume there is a (probably unintentional) backdoor. The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this: games::0:0:games:/nopath:/bin/false In ...
  • 571
47 votes
Accepted

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like: This code ...
  • 21.5k
36 votes
Accepted

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

This is targeting the Shellshock bug (which even has its own tag): GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows ...
  • 769
35 votes
Accepted

Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash ...
  • 34.4k
34 votes
Accepted

Where is Bash Shellshock vulnerability in source code?

CVE-2014-6271 CVE-2014-6271 was the first vulnerability discovered. A patch can be found here. From Wikipedia: Function definitions are exported by encoding them within the environment variable ...
  • 4,315
32 votes

How to do a privileges escalation with ping?

A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
29 votes

How do I secure Apache against the Bash Shellshock vulnerability?

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -...
  • 7,947
28 votes

Bypassing the command/script specified in /etc/passwd

You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and ...
  • 50.7k
25 votes
Accepted

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, ...
  • 366
21 votes

Provide subjectAltName to openssl directly on the command line

As of 2022, with OpenSSL ≥ 1.1.1, the following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net: openssl req -x509 -newkey rsa:4096 -sha256 -...
  • 341
19 votes
Accepted

Is replacing bash with another shell a prudent step?

To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include: ...
17 votes

Bypassing the command/script specified in /etc/passwd

I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more ...
  • 413
14 votes

Attack scenarios of the new Bash vulnerability

The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example: $ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-...
14 votes

What do shellshock attacks look like in system logs?

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"...
  • 7,535
13 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet ...
13 votes
Accepted

How can I use netcat like ping?

To identify if a server is running, you only need to determine if the port is open for requests. Using netcat, you can query a server like this: nc -z www.example.com 80 This will tell you if it's ...
  • 33.7k
12 votes

Is there a short command to test if my server is secure against the shellshock bash bug?

You can check if you're vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words "busted", then you're at risk. If only the second ...
  • 4,414
12 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's ...
  • 639
12 votes
Accepted

Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?

In theory, yes. But then you also have problems with LD_PRELOAD LD_LIBARAY BASH_ENV etc. The biggest problem with shellshock is that the name of the environment variable does not matter, bash would ...
12 votes

Provide subjectAltName to openssl directly on the command line

So I had a heck of a time getting this working right, and putting at all in Ansible. As Ansible's command module doesn't allow file-redirects (<(...)), I had to use a small .cnf file as a template, ...
  • 221
12 votes

Does a Turing complete shell means equal secure?

It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems ...
  • 1,269

Only top scored, non community-wiki answers of a minimum length are eligible