Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

159 votes
Accepted

What is a specific example of how the Shellshock Bash bug could be exploited?

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this ...
user avatar
  • 7,535
158 votes
Accepted

Provide subjectAltName to openssl directly on the command line

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit). The commit adds an example to ...
user avatar
  • 1,696
147 votes

Provide subjectAltName to openssl directly on the command line

Based on link from DarkLighting, here's the command I came up with using nested subshells. openssl req -new -sha256 \ -key domain.key \ -subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \ -...
user avatar
  • 1,571
125 votes
Accepted

Is there a short command to test if my server is secure against the shellshock bash bug?

Is my bash vulnerable? This simple command is a sufficient test to see if your version of bash is vulnerable: x='() { :;}; echo VULNERABLE' bash -c : It's not necessary to have extra text printed ...
user avatar
  • 1,315
100 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go ...
user avatar
59 votes

Hacked Ubuntu server, probably hacked commands (netstat, ps, ...), how to replace them?

You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.
user avatar
  • 15.4k
57 votes

Provide subjectAltName to openssl directly on the command line

This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me): openssl genrsa -out ca.key 2048 openssl req -new -x509 -days 365 ...
user avatar
  • 671
53 votes

Avast performing an attack?

This is probably an issue with the co-existance' of multiple realtime AV software. One will suspect the other one's activities as malicious. Avast is trying to scan your router/default gateway and ...
user avatar
  • 846
49 votes

Provide subjectAltName to openssl directly on the command line

My solution was to pass subjectAltName via an environment variable. First have this added to openssl.conf: [ san_env ] subjectAltName=${ENV::SAN} Then set the environment variable before invoking ...
user avatar
  • 721
48 votes
Accepted

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like: This code ...
user avatar
  • 21.5k
46 votes

Bypassing the command/script specified in /etc/passwd

Assume there is a (probably unintentional) backdoor. The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this: games::0:0:games:/nopath:/bin/false In ...
user avatar
  • 561
36 votes
Accepted

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

This is targeting the Shellshock bug (which even has its own tag): GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows ...
user avatar
  • 759
35 votes
Accepted

Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?

Define "risk". The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash ...
user avatar
  • 34.4k
34 votes
Accepted

Where is Bash Shellshock vulnerability in source code?

CVE-2014-6271 CVE-2014-6271 was the first vulnerability discovered. A patch can be found here. From Wikipedia: Function definitions are exported by encoding them within the environment variable ...
user avatar
  • 4,305
32 votes

How to do a privileges escalation with ping?

A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
user avatar
29 votes

How do I secure Apache against the Bash Shellshock vulnerability?

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -...
user avatar
  • 7,927
28 votes

Bypassing the command/script specified in /etc/passwd

You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and ...
user avatar
  • 50.5k
25 votes
Accepted

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, ...
user avatar
  • 366
19 votes
Accepted

Is replacing bash with another shell a prudent step?

To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include: ...
user avatar
19 votes

Provide subjectAltName to openssl directly on the command line

As of 2022, with OpenSSL ≥ 1.1.1, the following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net: openssl req -x509 -newkey rsa:4096 -sha256 -...
user avatar
  • 321
16 votes

Bypassing the command/script specified in /etc/passwd

I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more ...
user avatar
  • 413
14 votes

Attack scenarios of the new Bash vulnerability

The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example: $ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-...
user avatar
14 votes

What do shellshock attacks look like in system logs?

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"...
user avatar
  • 7,535
13 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet ...
user avatar
12 votes

Is there a short command to test if my server is secure against the shellshock bash bug?

You can check if you're vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words "busted", then you're at risk. If only the second ...
user avatar
  • 4,384
12 votes

What is a specific example of how the Shellshock Bash bug could be exploited?

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's ...
user avatar
  • 639
12 votes
Accepted

Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?

In theory, yes. But then you also have problems with LD_PRELOAD LD_LIBARAY BASH_ENV etc. The biggest problem with shellshock is that the name of the environment variable does not matter, bash would ...
user avatar
12 votes

Provide subjectAltName to openssl directly on the command line

So I had a heck of a time getting this working right, and putting at all in Ansible. As Ansible's command module doesn't allow file-redirects (<(...)), I had to use a small .cnf file as a template, ...
user avatar
  • 221
12 votes
Accepted

How can I use netcat like ping?

To identify if a server is running, you only need to determine if the port is open for requests. Using netcat, you can query a server like this: nc -z www.example.com 80 This will tell you if it's ...
user avatar
  • 33.6k
12 votes

Does a Turing complete shell means equal secure?

It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems ...
user avatar
  • 1,259

Only top scored, non community-wiki answers of a minimum length are eligible