0

I am trying to demonstrate the shellshock vulnerability according to the commands posted here.

I have taken two systems under consideration: the first one has a vulnerable bash in $PATH; the other has a patched version of bash in $PATH, and a "supposedly vulnerable" version in /opt/vulnerable, that has been compiled from source.

On the first system, I am able to successfully exploit the bug:

$ bash --version
GNU bash, version 4.1.2(1)-release (i386-redhat-linux-gnu)
[...]

$ cat << EOM | bash
> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
> EOM
vulnerable
this is a test

On the second system, as described above, there is a patched bash in $PATH and a recently (as in a few hours ago) compiled from source version of bash in /opt/vulnerable that should be vulnerable:

$ bash --version
GNU bash, version 4.3.11(1)-release (i686-pc-linux-gnu)
[...]

$ /opt/vulnerable/bin/bash
GNU bash, version 4.1.0(1)-release (i686-pc-linux-gnu)
[...]

I'm passing these commands through the default version to the vulnerable version, and I'm unable to exploit it:

$ cat << EOM | /opt/vulnerable/bin/bash
> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
> EOM
this is a test

I've also tried using this script for testing, but it fails to detect any vulnerability. (The command has been issued from the default, patched shell):

$ /opt/vulnerable/bin/bash shellshock_test.sh
CVE-2014-6271 (original shellshock): not vulnerable
CVE-2014-6277 (segfault): not vulnerable
CVE-2014-6278 (Florian's patch): not vulnerable
CVE-2014-7169 (taviso bug): not vulnerable
CVE-2014-7186 (redir_stack bug): not vulnerable
CVE-2014-7187 (nested loops off by one): not vulnerable
CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable

Am I doing something wrong here? Or have all bash sources archives on ftp.gnu.org have been patched against this vulnerability?

  • 5
    Isn't the second line running bash from $PATH instead of /opt/vulnerable? – Mikel Nov 18 '15 at 16:12
  • @Mikel, are you talking about the "second line" from the first code block? That's just some information taken from a system with a vulnerable bash in $PATH to confirm that versions <= 4.1.2 have this vulnerability. – user2064000 Nov 18 '15 at 20:08
2
$ cat << EOM | /opt/vulnerable/bin/bash
> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
> EOM

Is wrong.

On the 2nd line, you're calling bash, which will use the version in $PATH 1.

You want to use the version of bash in /opt/vulnerable/bin/bash, like this:

$ cat << EOM | /opt/vulnerable/bin/bash
> env x='() { :;}; echo vulnerable' /opt/vulnerable/bin/bash -c "echo this is a test"
> EOM

Tho I can't see any need for you to call bash twice and use a pipe like that. Why not just:

$ env x='() { :;}; echo vulnerable' bash -c 'echo this is a test'

and

$ env x='() { :;}; echo vulnerable' /opt/vulnerable/bin/bash -c 'echo this is a test'

I verified using bash versus ~/src/bash/bash on my system:

$ env x='() { :;}; echo vulnerable' bash -c 'echo $BASH_VERSION'
4.3.11(1)-release

$ env x='() { :;}; echo vulnerable' ~/src/bash/bash -c 'echo $BASH_VERSION'
4.3.42(1)-release

Footnotes:

  1. Or a function, an alias, the version in hash, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.