159
votes
Accepted
What is a specific example of how the Shellshock Bash bug could be exploited?
A very simple example would be a cgi, /var/www/cgi-bin/test.cgi:
#!/bin/bash
echo "Content-type: text/plain"
echo
echo
echo "Hi"
Then call it with wget to swap out the User Agent string. E.g. this ...
- 7,535
158
votes
Accepted
Provide subjectAltName to openssl directly on the command line
As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit).
The commit adds an example to ...
- 1,696
147
votes
Provide subjectAltName to openssl directly on the command line
Based on link from DarkLighting, here's the command I came up with using nested subshells.
openssl req -new -sha256 \
-key domain.key \
-subj "/C=US/ST=CA/O=Acme, Inc./CN=example.com" \
-...
- 1,571
125
votes
Accepted
Is there a short command to test if my server is secure against the shellshock bash bug?
Is my bash vulnerable?
This simple command is a sufficient test to see if your version of bash is vulnerable:
x='() { :;}; echo VULNERABLE' bash -c :
It's not necessary to have extra text printed ...
- 1,315
100
votes
What is a specific example of how the Shellshock Bash bug could be exploited?
With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb:
() { :; }; :(){ :|: & };:
Just put that in a user agent string on a browser, go ...
- 761
59
votes
Hacked Ubuntu server, probably hacked commands (netstat, ps, ...), how to replace them?
You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.
- 15.4k
57
votes
Provide subjectAltName to openssl directly on the command line
This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me):
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 ...
- 671
53
votes
Avast performing an attack?
This is probably an issue with the co-existance' of multiple realtime AV software. One will suspect the other one's activities as malicious.
Avast is trying to scan your router/default gateway and ...
- 846
49
votes
Provide subjectAltName to openssl directly on the command line
My solution was to pass subjectAltName via an environment variable.
First have this added to openssl.conf:
[ san_env ]
subjectAltName=${ENV::SAN}
Then set the environment variable before invoking ...
- 721
48
votes
Accepted
Is using 'echo' to display attacker-controlled data on the terminal dangerous?
Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like:
This code ...
- 21.5k
46
votes
Bypassing the command/script specified in /etc/passwd
Assume there is a (probably unintentional) backdoor.
The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this:
games::0:0:games:/nopath:/bin/false
In ...
- 561
36
votes
Accepted
What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash
This is targeting the Shellshock bug (which even has its own tag):
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows ...
- 759
35
votes
Accepted
Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?
Define "risk".
The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash ...
- 34.4k
34
votes
Accepted
Where is Bash Shellshock vulnerability in source code?
CVE-2014-6271
CVE-2014-6271 was the first vulnerability discovered. A patch can be found here.
From Wikipedia:
Function definitions are exported by encoding them within the
environment variable ...
- 4,305
32
votes
How to do a privileges escalation with ping?
A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
- 632
29
votes
How do I secure Apache against the Bash Shellshock vulnerability?
Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -...
- 7,927
28
votes
Bypassing the command/script specified in /etc/passwd
You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and ...
- 50.5k
25
votes
Accepted
GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?
I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, ...
- 366
19
votes
Accepted
Is replacing bash with another shell a prudent step?
To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include:
...
19
votes
Provide subjectAltName to openssl directly on the command line
As of 2022, with OpenSSL ≥ 1.1.1, the following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net:
openssl req -x509 -newkey rsa:4096 -sha256 -...
- 321
16
votes
Bypassing the command/script specified in /etc/passwd
I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more ...
- 413
14
votes
Attack scenarios of the new Bash vulnerability
The easiest way to test a web server via HTTP request is to inject the bash command through the user agent. Example:
$ wget -U '() { :;}; /bin/bash -c "echo vulnerable"' http://example.com/some-cgi-...
- 5,210
14
votes
What do shellshock attacks look like in system logs?
This is an entry from my access_log of what my coworker did to my test machine... :
10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"...
- 7,535
13
votes
What is a specific example of how the Shellshock Bash bug could be exploited?
It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet ...
- 231
12
votes
Is there a short command to test if my server is secure against the shellshock bash bug?
You can check if you're vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words "busted", then you're at risk. If only the second ...
- 4,384
12
votes
What is a specific example of how the Shellshock Bash bug could be exploited?
You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's ...
- 639
12
votes
Accepted
Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?
In theory, yes. But then you also have problems with
LD_PRELOAD
LD_LIBARAY
BASH_ENV
etc.
The biggest problem with shellshock is that the name of the environment variable does not matter, bash would ...
- 294
12
votes
Provide subjectAltName to openssl directly on the command line
So I had a heck of a time getting this working right, and putting at all in Ansible. As Ansible's command module doesn't allow file-redirects (<(...)), I had to use a small .cnf file as a template, ...
- 221
12
votes
Accepted
How can I use netcat like ping?
To identify if a server is running, you only need to determine if the port is open for requests. Using netcat, you can query a server like this:
nc -z www.example.com 80
This will tell you if it's ...
- 33.6k
12
votes
Does a Turing complete shell means equal secure?
It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems ...
- 1,259
Only top scored, non community-wiki answers of a minimum length are eligible