6

Given a script that allows anyone to provide input. Is there any input that can break out of a variable. For example given the following script:

echo $1

Would there be anyway to make $1 something like:

text && rm -rf /

I'm trying to do something like the above and it doesn't work.

Can anyone confirm that the above would be impossible?

  • 1
    Shellshock? But I think most versions have been patched. – RubberStamp Nov 4 '17 at 20:46
  • @RubberStamp interesting I'd never heard of that looks like it was fairly recent. – Philip Kirkbride Nov 4 '17 at 20:48
  • 1
    Here's a description of how to test if you are vulnerable ServerFault Shellshock Question – RubberStamp Nov 4 '17 at 20:51
  • @RubberStamp I think if you post that as an answer it would be more correct. If this was patched in 2014 there are likely still a lot of old machines running vulnerable code? – Philip Kirkbride Nov 4 '17 at 20:58
  • 1
    In this case, if echo supports option -e, you might be able to do something malicious with control chars or terminal escape sequences, but I can't find anything specific. – wjandrea Nov 5 '17 at 3:08
5

In 2014, there was a exploit in the wild for a Bash vulnerability nicknamed Shellshock. Like most vulnerabilities in common software, a Common Vulnerabilities and Exposures (CVE) Bulletin was released, CVE-2014-6278. Shellshock is a remote exploit for Bash which allowed arbitrary code execution on the remote host via several attack vectors in common server software stacks including Apache's cgi modules as well as OpenSSH.

The vulnerability affects all versions of Bash from 1989 until 2014 when it was patched once easily created exploits were widely demonstrated.

For further reading:

OWASP Shellshock Presentation, PDF

NIST CVE-2014-6278

ServerFault Shellshock Question, 2014

I believe most versions available in Distro Repos have been patched.

Correction: Shellshock is a family of vulnerabilities... CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187

And, it's good to remember that these can easily affect a LAN if there exists port forwarding for things like Apache web servers or SSH... as well as any unpatched (and probably unpatchable) Internet of Things devices.

4

Command separators are processed before expansions, therefore there is no way that \n, ;, &, &&, or || in a variable will ever have an effect unless the variable contents are evaled.

3

It seems like globbing is a vulnerability:

$ echo 'echo $1' > injection.sh
$ bash injection.sh '/*'
/bin /boot /dev /etc /home /lib /lib64 /media /mnt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var

This is why you always quote vars:

$ echo 'echo "$1"' > injection.sh
$ bash injection.sh '/*'
/*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.