Since I’m using Kali Linux, both cURL and Netcatare already installed but you may need to install these on your machine if you are following along. In the case of our demonstration we are going to set-up a Reverse Shell which will allow the attacking machine execute commands on the target machine.
When we have two Netcat instances connected to each other, we can start to do some interesting things. One of the many uses of Netcat is the ability to set up Netcat in either Listening or Server modes. We will also use a tool called Netcat this is a network tool that can be used to read and send data over the network. It’s not a graphical browser (such as Firefox, IE or Chrome) but instead fetches the content of the pages in a raw format. Another option (and the one used in this demo) is to use cURL, this is a command line tool that allows us to interact with web-servers and have a finer level of control over what is being sent. One option would be to use a HTTP proxy such as OWASP ZAP, Burp Suite, Fiddler or Charles Proxy these allow you to intercept HTTP traffic and alter the HTTP request that is being sent. In the case of normal browsing, we have little control over items the HTTP headers as these are set by the browser however other tools exist to allow us to alter these values. However HTTP Headers are common to all pages so we will focus our attentions on these. It’s worth noting that if a page had query or form parameters then these would also be converted into environment parameters that can be accessed. This is where the Shellshock vulnerability lies, since we saw earlier that setting a parameter to a function and then appending our malicious payload after the function definition causes the payload to be executed automatically. Apache has taken the standard HTTP headers, created environment parameters and passed these to the CGI script.
You can see from this that the list of environment variables available to the CGI script includes items such as HTTP_USER_AGENT and REQUEST_METHOD. When I navigate to I see the following page. This is a really simple script that displays a basic HTML page but includes an output of the environment variables available to the CGI script ( echo $(env)).
In this post we’ll look at how Shellshock may impact web-servers that use the bash shell for scripting.īefore we get started – remember that testing for Shellshock on systems that you do not have permission to do so may mean you fall foul of local laws. In the previous post we looked at what the classic Shellshock behaviour is from the command line.
0 kommentar(er)
