关联漏洞
标题：
GNU Bash 远程代码执行漏洞
(CVE-2014-6271)
描述：GNU Bash是美国软件开发者布莱恩-福克斯（Brian J. Fox）为GNU计划而编写的一个Shell（命令语言解释器），它运行于类Unix操作系统中（Linux系统的默认Shell），并能够从标准输入设备或文件中读取、执行命令，同时也结合了一部分ksh和csh的特点。 GNU Bash 4.3及之前版本中存在安全漏洞，该漏洞源于程序没有正确处理环境变量值内的函数定义。远程攻击者可借助特制的环境变量利用该漏洞执行任意代码。以下产品和模块可能会被利用：OpenSSH sshd中的ForceComman
描述
Shellshock exploit aka CVE-2014-6271
介绍
# CVE-2014-6271 - Shellshock.py
Shellshock exploit aka CVE-2014-6271. <br>
Tested on Bash 3.2 and Bash 4.2. <br>
For more information about the vulnerability visit : https://nvd.nist.gov/vuln/detail/CVE-2014-6271
## Note
---
The exploit was mainly tested on **Hack The Box** in the following boxes:
- `Beep` box : https://app.hackthebox.eu/machines/Beep
- `Shocker` box : https://app.hackthebox.eu/machines/Shocker
<br>
This exploit will only work on web servers having a version of Bash < 4.3.<br>
In some cases, if you are able to get a HTTP 200 code on your web browser<br>
by doing a GET request to the `/cgi-bin/`, you could just try to run the exploit against that directory.<br><br>
Otherwise if you have a 403 on the `/cgi-bin/` directory, try to enumerates for files<br>
within that directory with a good wordlist, searching for `.sh` or `.cgi` extensions.<br>
**NOTE: Don't forget to setup your TCP listenner, otherwise the exploit might give you**
**a false positive during the testRevShell call check**<br><br>
## Proof of Concept (POC)
---
First of all we can see the arguments that the exploit is taking by running: `shellshock.py -h`<br><br>
 <br><br>
Then we can set up a Ncat listenner on a port of our choice, here I chose 45<br><br>
 <br><br>
Next we can run the exploit by supplying all the arguments that it takes by running:<br> `shellshock.py [OUR_IP] [OUR_LISTENNING_PORT] [TARGET_URL]`<br>
The target URL here as you can see is where the web server sends a POST request during authentication on that box <br><br>
Here as we can see in the output, the exploit tried sending the payload over SSL using multiple TLS versions, until it succeed <br><br>
 <br><br>
And here we got our reverse shell! Lucky enough, the web server was running as root. <br><br>
 <br>
文件快照
[4.0K] /data/pocs/7ed6cda91425529593a24b0f03f3631be1ae35ed
├── [4.0K] img
│ ├── [154K] poc_pre_shell.png
│ ├── [273K] poc_script_help.png
│ ├── [299K] poc_script.png
│ └── [194K] poc_shell.png
├── [1.9K] README.md
└── [7.2K] shellshock.py
1 directory, 6 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。