CVE-2014-6271 (Shellshock) Python Exploit

A clean, efficient, and interactive Python implementation designed to test for the Shellshock vulnerability (CVE-2014-6271) via HTTP environment variable injection.

📝 Description

Shellshock (CVE-2014-6271) is a critical security vulnerability in the Bash shell that allows attackers to execute arbitrary commands by trailing them at the end of function definitions stored in environment variables.

This script targets web servers using CGI (Common Gateway Interface) scripts. When a server passes HTTP headers (like User-Agent) to a Bash-based CGI script, this tool injects a malicious payload to hijack the execution flow and run system commands.

🚀 Features

• Interactive Shell: Enter commands in a persistent loop without restarting the script.
• Optimized Payload: Automatically handles the necessary HTTP echo headers to ensure command output is visible.
• Colorized CLI: Built with colorama for a clear, professional interface.
• Robust Networking: Includes error handling for timeouts and connection exceptions.
• Blind Testing Support: Useful for testing "silent" vulnerabilities via time-based commands.

🛠 Installation

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/im2nerd/CVE-2014-6271
   

2. Install dependencies:

pip install requests colorama

⚠️ Legal Disclaimer

WARNING: This tool is intended for educational purposes and authorized ethical hacking/penetration testing only. Attacking targets without prior explicit consent is illegal and punishable by law. The author assumes no liability for any misuse or damage caused by this program.