Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2014-6271_pwnable — Hands-on lab demonstrating the Shellshock (CVE-2014-6271) Bash vulnerability with privilege escalation via environment variable injection, based on the pwnable.kr challenge. | Kitploit
Tools/GitHubGitHub/hanmin0512/cve-2014-6271_pwnable
Vulnerability AnalysisExploitationCTFLearning & EducationBinary ExploitationLabs & Practice
GitHubhanmin0512/cve-2014-6271_pwnable

CVE-2014-6271_pwnable

Hands-on lab demonstrating the Shellshock (CVE-2014-6271) Bash vulnerability with privilege escalation via environment variable injection, based on the pwnable.kr challenge.

View Repository
23 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2014-6271

  • CVE-2014-6271 is a critical vulnerability known as "Shellshock", discovered and disclosed in 2014. This vulnerability was found in the Bash shell and affects almost all Unix and Linux systems, making it one of the most widely known vulnerabilities on the internet.

Security Threat

  • The Shellshock vulnerability allows arbitrary code execution via environment variables in the Bash shell. Attackers could inject malicious code into the system by manipulating specific environment variable values. This could be exploited to control the system or steal user information.

Lab Environment

  • We will practice using the pwnable.kr shellshock challenge.
  • ssh [email protected] -p2222
  • pw: guest

Attack Method

  • The shellshock vulnerability exploits the fact that when environment variables are set using syntax similar to a function, the bash shell will recognize them as functions when loading them.
  • By maliciously setting the environment variable value to function-like syntax followed by a ';' and a command, when bash is executed, the command after the semicolon is executed.
  • Setting environment variables (example)

0

  • Setting functions (example) (export -f is an option that makes functions available in other sessions/subprocesses)

1

  • Attempting an attack using environment variable setting

2

  • I tried to read the flag by setting the environment variable value with function syntax so that bash recognizes it as a function, and then appending a command, but it failed due to insufficient permissions.

  • Looking at the shellshock.c code, it elevates the effective group ID and then executes bash.

3

  • When bash is executed as a subprocess, it initializes the exported attack environment variable; during that process, it is recognized as a function and the command following it is executed.
  • When shellshock is executed, the group ID is elevated, granting permission to read the flag. Since the program executes bash, the inserted command /bin/cat flag is executed during that process.

4

Download Tool