# CVE-2014-6271
A vulnerability known as "ShellShock" exists in GNU Bash through 4.3 due to how it processes trailing strings in the values of environment variables after function definitions. This vulnerability enables remote attackers to execute arbitrary code by crafting the environment in certain situations, including when the environment is set across a privilege boundary from Bash execution. The vulnerability has been demonstrated in various scenarios, such as the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, and scripts executed by unspecified DHCP clients. It should be noted that the original fix for this vulnerability was incorrect, and a separate CVE, CVE-2014-7169, has been assigned to cover the still-present vulnerability after the incorrect fix.
# Execution
```python exploit.py -r <rhost-url> -c <desired-command>```
<img src="https://i.ibb.co/581Rd6f/shell-shock.png" alt="shell-shock" border="0">
# Reference
[NIST NVD](https://nvd.nist.gov/vuln/detail/cve-2014-6271)
[MITRE Corporation](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6271)
[4.0K] /data/pocs/ec00a84343b19a1a04ad389784cad669fec1ef49
├── [1.2K] exploit.py
└── [1.1K] README.md
0 directories, 2 files