15 ms·
Shellshock DHCP Remote Code Execution – Proof of Concept
- halfdeadcat 12y agoSo, an exploit using off-the-shelf software. Just awesome.
- tokenizerrr 12y agoWell, yes. If you were going to exploit CGI scripts you'd likely use wget or curl instead of coding an HTTP client from scratch so why is this suprising?
- halfdeadcat 12y agoIt's a little surprising because I'm tempted to classify this one as 'requires 0 lines of code'.
- zobzu 12y agoits pretty much the same for CGIs, its a one liner. theres other exploits like that. it happens :)
- danielweber 12y agoI was going to do this this evening and now he's saved me the time. Thanks! :)
- jeffmcjunkin 12y agoNote that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time. A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability. [1] http://linux.die.net/man/5/dhcpd-options http://linux.die.net/man/5/dhcpd-options (search for "dhcp-parameter-request-list") [2] http://tftpd32.jounin.net/ http://tftpd32.jounin.net/
- makomk 12y agoThankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.
- tdicola 12y agoAre smaller shells like busybox affected though? I bet a lot of routers run it (I know mine with OpenWRT does).
- jeffmcjunkin 12y agoNo, busybox is not affected.
- masklinn 12y agoThe problem is very specific to bash and bash only (a hacky feature via environment variables so shells can inherit their parent's functions)
- jeffmcjunkin 12y agoVery true. To be clear to other readers, busybox is more common in smaller embedded devices, though today's AlienVault blog post [1] showed that Mitel VoIP systems (which use Debian/ARM, if I recall) use bash and are vulnerable. [1] http://www.alienvault.com/open-threat-exchange/blog/attackers-exploiting-shell-shock-cve-2014-6721-in-the-wild http://www.alienvault.com/open-threat-exchange/blog/attacker...
- dfc 12y agoThe default /bin/sh in Debian is dash.
- arielby 12y agoNote that if you try to do the exploit via the hostname or another common option, the CVE-2011-0997 fix will stop you. However, the fix is incomplete - it does not check all options, only the ones the old CVE's fixers thought of.
- syshax 12y agoThanks for the info. Has anyone tried this with an OS X client to see if it behaves like the Linux system in the article? I know OS X bash is vulnerable to the exploit, but I don't know if their DHCP system handles environment variables in an exploitable way.
- somemacsysadmin 12y agoOS X doesn't use Bash for configuring DHCP, so it's not vulnerable. All of that is done in the kernel on Macs.
- akkartik 12y agoDoes this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?
- jeffmcjunkin 12y agoThis means that DHCP clients that use bash and have DHCP server-controlled environment variables can have commands injected (as root) by a malicious DHCP server. Notably, attackers in an unhardened network can reply to DHCP clients themselves, even if there's already a DHCP server on the network. So it's not just the sysadmin who can exploit this, but anyone on the same network (broadcast domain) as the vulnerable DHCP client.
- akkartik 12y agoAlright, I'm shutting down my cable modem. See y'all later.
- krek 12y agoThis is best plain English explanation I've seen yet (been looking for an hour). Thanks.
- nqzero 12y agowhy is a DHCP client calling bash for anything ? that's just a terrible way to program. and doubly so for passing unscrubbed data to it as environment variables
- mr_brown 12y agoI believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP http://www.amazon.com/s/field-keywords=QNAP
- dharma1 12y agojust ssh'd into my WD mycloud.. yep it's vulnerable WDMyCloud:~# ls -l /bin/sh lrwxrwxrwx 1 root root 4 Jun 30 08:38 /bin/sh -> bash
- tacoman 12y agoThere are a bunch of daemons running on a fully configured My Cloud. I haven't had much success in finding anything yet, but yeah, it has the bug. nas:~# bash --version | head -1 GNU bash, version 4.2.37(1)-release (arm-unknown-linux-gnueabihf) nas:~# uname -a Linux nas 3.2.26 #1 SMP Tue Jun 17 15:53:22 PDT 2014 wd-2.2-rel armv7l GNU/Linux nas:~# env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test EDIT: formatting.
- syshax 12y agoJust FYI to other owners: Synology DSM 5.0-4493 Update 5 here: it uses busybox, so not vulnerable. synology> which bash synology> which sh /bin/sh synology> which ash /bin/ash synology> ls -l /bin/sh lrwxrwxrwx 1 root root 7 Jun 5 11:27 /bin/sh -> busybox synology> ls -l /bin/ash lrwxrwxrwx 1 root root 7 Jun 5 11:27 /bin/ash -> busybox
- adamfeldman 12y agoThank you for checking out DSM! This comment saved me a bunch of time.
- dubfan 12y agoGiven the rate at which QNAP issues updates I'm not expecting it to be fixed for at least another month, and that will most likely be a beta release. I like my QNAP NAS but I don't think I'd buy another QNAP product. They are just too unresponsive to these sorts of things.
- Klasiaster 12y agoone more reason for networking done by network-manager or networkd (systemd) instead of bash scripts
- kbar13 12y agothat's some straw man you got there. Just because bash is vulnerable in this case doesn't mean that networkd/network-manager will never be vulnerable.
- danielweber 12y agoDoes NetworkManager completely obviate the need for the DHCP binary to call shell scripts? Those scripts often exist because if the sysadmin needs something special to happen on DHCP, this is where he sets it. It's not "DHCP scripts get run by/are shell scripts," it's "DHCP binaries are prepared to call out to external scripts." I've had to write these shell scripts (using ksh, since OpenBSD, so those are safe).
- Maken 12y agoWell, Network Manager for starters is a binary and not a shell script like the dhclient-script.
- danielweber 12y agodhclient is a binary on Linux and OpenBSD. It calls shell scripts, because, like I said in the comment you replied to, sometimes sysadmins need very specific things to happen when the machine gets a DHCP lease.
- dfc 12y agoNetwork manager depends on "the dhclient-script." > A variety of other system services are used by NetworkManager > to provide network functionality wpasupplicant for wireless > connections and 8021x wired connections pppd for PPP and > mobile broadband connections DHCP clients for dynamic IP > addressing http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/README#n51 http://cgit.freedesktop.org/NetworkManager/NetworkManager/tr...
- technimad 12y agoAnother reason to implement DHCP snooping on your network gear.
- smutticus 12y agoThat's what I was thinking. If you let random machines on your network hand out DHCP addresses you've got bigger problems.
- SchizoDuckie 12y agoHoly shit that is scary. Package this on an android phone and you can wreak havoc on any random network
- orblivion 12y agoAssuming it's a network full of machines who haven't bothered updating yet. EDIT: right?
- dmethvin 12y agoUm, "haven't bothered"? Think about all the Linux/Unix-based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than 24 hours now.
- orblivion 12y agoHow many of them run bash? I'm about to check my router (I didn't think of it until today), but I read that Tomato runs busybox which I understand is not affected.
- takeda 12y ago> Linux/Unix-based Actually it's primarily Linux because /bin/sh is pointing to bash.
- josteink 12y ago> How about your Linux-based router? In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected. Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.
- orblivion 12y ago
- cpg 12y agoWow, that is scary how a simple DHCP option can propagate like that. Speaking of Linux-based NAS systems, Amahi systems have been updated via a repo update that pulls the latest bash fix.
- vibrolax 12y agoFreeNAS (based on FreeBSD 9.2) has a vulnerable bash. I have 9.2.1.7.
- masklinn 12y agoFreeNAS doesn't use bash as /bin/sh by default or as root shell unless you've set it yourself (which some users do: http://forums.freenas.org/index.php?threads/replacing-standard-shell-with-bash-for-root.21321/ http://forums.freenas.org/index.php?threads/replacing-standa...)
- vibrolax 12y agoYes. In this thread: http://forums.freenas.org/index.php?threads/its-bashs-turn-to-have-a-security-hole.23698/ http://forums.freenas.org/index.php?threads/its-bashs-turn-t... a user speculates that bash is included only for user convenience. I didn't know if repeating this speculation was HN-worthy, so I only reported what I knew for fact. The following indicates than a patched bash is forthcoming: http://lists.freenas.org/pipermail/freenas-commit/2014-September/004196.html http://lists.freenas.org/pipermail/freenas-commit/2014-Septe...
- lambda 12y agoThe question is, does it call bash in its dhclient-script? I took a look through the FreeBSD source tree, and their version of dhclient-script uses /bin/sh. As long as /bin/sh is not bash (and that script doesn't in turn call any other bash scripts) it should be OK. The best way to find out if you're vulnerable is by testing. It takes just a few minutes to set up dnsmasq to serve up an exploit. Here were my settings: interface=eth2 dhcp-range=10.0.1.100,10.0.10.200,12h dhcp-option-force=114,() { :; }; echo "hi" Of course, replace that 'echo "hi"' with the exploit of your choice. In my case, the output from dhclient would be printed on screen when restarting networking, so 'echo "hi"' was sufficient to verify that it was being executed. If any bash scripts are called, with the environment variables that are set by dhclient, then that snippet should be run. If bash is not invoked, then that snippet won't ever run.
- 12y ago
- iLoch 12y agoI think one of the things Heartbleed PoCs did really well was show the result for the end user. Most people aren't going to know what any of this stuff means. Can we come up with a really straight forward explanation in laymans terms as to what this means for the average Internet user?
- bx_ 12y agohttp://shellshock.co.za/ http://shellshock.co.za/ i thought this was pretty straightforward
- justrandomanon 12y agoofftopic why do people use custom scrolling behaviour? it's always horrible
- hardwaresofton 12y agoYeah, I don't think anyone has grasped the extent of how dangerous this vuln is -- was it released a little prematurely? is it still in "embargo"? This is hundreds of times worse than heartbleed in terms of scope/attack surface for modern servers... (I say hundreds of times worse because heartbleed was scrape-some-data-till-you-get-private-keys-and-watch-communication, where this is just get-yourself-a-shell-and-pwn-the-machine)
- ossreality 12y agolmao "embargo" seriously? How are there still people in every single one of these threads whining about responsible disclosure. The fact that they tried to "responsibly disclose" and "embargo" and THIS is what happened is proof of why not to even bother. So silly...
- ams6110 12y agoOn the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.
- lbruder 12y agoWhile not exactly thrilled, as a Linux user I have to admit it's only fair. That's exactly what some of us did all those years when Windows used to have more holes than Linux. Ah well, back to BSD I guess...
- hardwaresofton 12y agoHmnn well I wonder just how much safer BSD is compared to Linux... I would consider linux to have more eyes on it, and if I remember correctly, LibreSSL was not infallible (despite all the shaming of OpenSSL folks that went on)
- deleted 12y ago[deleted]
- 12y ago
- guest0925 12y agoWhy did the quotes show up?
- sambe 12y agoMy first reaction too. However, it's not hard to imagine some escaping being thrown in there at some point.
- slavik81 12y agoWhat DHCP service is this and how do I tell if I'm using it?
- schwag09 12y agoI created a python + scapy poc: https://github.com/mschwager/shellshock_poc https://github.com/mschwager/shellshock_poc I tested it with my laptop and android phone on my wifi network.
- exploit 12y agoI've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP address leasetime 600 (10m) OPTION: 1 ( 4) Subnet mask 255.255.255.0 OPTION: 3 ( 4) Routers 192.168.1.1 OPTION: 15 ( 39) Domainname () { :;}; cat /etc/shadow > /tmp/shadow What could be the problem?
- lambda 12y agoWhat were you using to configure networking on the target machine? NetworkManager, ifupdown, something else? I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if-.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.
- exploit 12y agoOf course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager (https://github.com/mschwager/shellshock_poc https://github.com/mschwager/shellshock_poc), may be it will be OK.
- phunge 12y agoI'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?
- dfc 12y agoHow do you have dash/bash setup: # debconf-show dash * dash/sh: true true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.
- hyperbovine 12y agocurl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash Let's hope that script does what it claims to do :)
- bostik 12y agoEven if that was meant as a joke, I do hope you realise the irony. To protect against running untrusted code in a shell, you ... run code from an untrusted source in the shell. As root.
- hyperbovine 12y agoYes :-)
- zurn 12y agoSo is the default dhclient conf vulnerable in any of the Linux distributions using bash for /bin/sh (eg CentOS/Fedora)? edit: According to one poster on Stackexchange, Debian/Ubuntu may be vulerable despite not having bash for /bin/sh: "What's more, on Debian (and possibly many of its myriads of offsprings like Ubuntu), which uses dash as /bin/sh, dhclient-script is explicitely shebanged to /bin/bash, and it does seem to contain a bashism, too" (https://security.stackexchange.com/questions/68156/is-connecting-to-an-open-wifi-router-with-dhcp-in-linux-susceptible-to-shellshoc https://security.stackexchange.com/questions/68156/is-connec...)
- mariusz79 12y agoSo now we can have dhcp-option-force=114,() { :; }; if hash apt-get 2>/dev/null; then apt-get update -y && apt-get upgrade -y;fi; if hash yum 2>/dev/null; then yum update;fi; to upgrade most vulnerable systems that connect to our network :) What other upgrade commands are there?
- mariusz79 12y agoIt would be even better if we could create a community driven script hosted at some trusted location that would basically download info how to upgrade specific distribution, and execute that script on the vulnerable system.. so something like wget fix && chmod +x fix && ./fix :)
- pyvpx 12y agothat would be one juicy target to compromise...
- neersighted 12y agoThen what would happen if someone compromised the fix?
- jnorthrop 12y agoThat sounds like what Max Butler was busted for back in the late 1990's when he wrote a script to patch BIND[1]. It's a great story BTW. http://en.wikipedia.org/wiki/Max_Butler#FBI_investigation.2C_guilty_plea.2C_and_sentencing http://en.wikipedia.org/wiki/Max_Butler#FBI_investigation.2C...
- deleted 12y ago[deleted]
- 1wd 12y agoIs it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.
- Corrado 12y agoWhich brings to mind the latest push for systemd as an init replacement. :/
- shaurz 12y agoOf course systemd theoretically allow systems to boot without any shell installed.
- lambda 12y agoOne thing to recall is that much of the complexity in systemd comes from replacing a whole bunch of dodgy, special purpose code written in shell scripts (init scripts) and in the daemons it manages (daemonization code, various kinds of racy startup dependencies, etc). Just saying "systemd is complex" is fairly sloppy thinking; the question is, is it more or less complex than re-implementing that functionality poorly and incompatibly several dozen other times in various other daemons and startup scripts?
- vertex-four 12y agoThere's significantly less complex ways to do this sort of thing, though. One that I've been looking at implementing into a distro lately is nosh[0] (and execline[1]). Every bit of code is implemented as a separate, independent utility that can be chained together through the nosh/execlineb "shell", which does no parsing and only a tiny bit of lexing. This way, it's easy to pick and choose what features and complexity each script needs, and the features that you don't use can't affect you. Nothing is running on your system that you don't know about, and there's no complex "magic" anywhere unless you explicitly ran a command which does magic things. [0] http://homepage.ntlworld.com/jonathan.deboynepollard/Softwares/nosh.html http://homepage.ntlworld.com/jonathan.deboynepollard/Softwar... [1] http://skarnet.org/software/execline/ http://skarnet.org/software/execline/
- deleted 12y ago[deleted]
- propercoil 12y agoI don't know if I'm clear after the update. Is my bash version patched or is it patched only for the first vulnerability? GNU bash, version 4.2.37(1)-release (x86_64-pc-linux-gnu)
- panzi 12y agoWhy does the output say 'foo' and not just foo? That looks suspicious.
- carsonreinke 12y agoAnybody try this with an iPhone? Not sure if bash is even installed on it.
- rsmarples 12y agodhcpcd-6.4.7 is hot off the press, the main improvement being mitigating the bash "ShellShock" exploit by escaping all characters as noted in IEEE Std 1003.1, 2004 Edition, 2. Shell Command Language, 2.2 Quoting except for the space character. Needless to say, the entire BSD family is not affected by this bug as bash is not the default shell and to be fair a lot of Linux distributions are not affected either. If bash is your Linux distributions /bin/sh, OR you have applications directly calling bash, you should be telling them to get with the times as most people have since moved on to ash, dash or busybox for more efficient processing. Regardless, shell is such an important in part of the system - it allows non programmers to "do things". Thanks to the dhcpcd hook system, a user was able to start tcpdump on hotplugged interface before dhcpcd actually started using it during the boot process. Why he wanted to do this, I don't know, probably for some debugging. But the point is, how would he have done this without shell hooks? The important thing to take away from this is don't lock yourself into one technology - strive to be portable. dhcpcd works on many OS's, libcs, shells and userland tools. If any of them prove faulty, swap them out - including dhcpcd itself! But please at least tell me why you're swapping dhcpcd out so I can improve it :)