3 ms·

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; c

by exploit 12y ago

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP address leasetime 600 (10m) OPTION: 1 ( 4) Subnet mask 255.255.255.0 OPTION: 3 ( 4) Routers 192.168.1.1 OPTION: 15 ( 39) Domainname () { :;}; cat /etc/shadow > /tmp/shadow What could be the problem?

lambda 12y ago
What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else? I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if-.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.
- exploit 12y ago
  Of course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager (https://github.com/mschwager/shellshock_poc https://github.com/mschwager/shellshock_poc), may be it will be OK.
phunge 12y ago
I'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?
dfc 12y ago
How do you have dash/bash setup: # debconf-show dash * dash/sh: true true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.

by exploit 12y ago

lambda 12y ago

What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else? I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if-.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.

exploit 12y ago
Of course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager (https://github.com/mschwager/shellshock_poc https://github.com/mschwager/shellshock_poc), may be it will be OK.

phunge 12y ago

I'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?

dfc 12y ago

How do you have dash/bash setup: # debconf-show dash * dash/sh: true true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.