CVE-2014-6271_pwnable

CVE-2014-6271

• CVE-2014-6271 is a critical vulnerability known as "Shellshock", discovered and disclosed in 2014. This vulnerability was found in the Bash shell and affects almost all Unix and Linux systems, making it one of the most widely known vulnerabilities on the internet.

Security Threat

• The Shellshock vulnerability allows arbitrary code execution via environment variables in the Bash shell. Attackers could inject malicious code into the system by manipulating specific environment variable values. This could be exploited to control the system or steal user information.

Lab Environment

• We will practice using the pwnable.kr shellshock challenge.
• ssh [email protected] -p2222
• pw: guest

Attack Method

• The shellshock vulnerability exploits the fact that when environment variables are set using syntax similar to a function, the bash shell will recognize them as functions when loading them.
• By maliciously setting the environment variable value to function-like syntax followed by a ';' and a command, when bash is executed, the command after the semicolon is executed.
• Setting environment variables (example)

• Setting functions (example) (export -f is an option that makes functions available in other sessions/subprocesses)

• Attempting an attack using environment variable setting

• I tried to read the flag by setting the environment variable value with function syntax so that bash recognizes it as a function, and then appending a command, but it failed due to insufficient permissions.

• Looking at the shellshock.c code, it elevates the effective group ID and then executes bash.

• When bash is executed as a subprocess, it initializes the exported attack environment variable; during that process, it is recognized as a function and the command following it is executed.
• When shellshock is executed, the group ID is elevated, granting permission to read the flag. Since the program executes bash, the inserted command /bin/cat flag is executed during that process.