All right show Shaw.
So what is show show.
2014 was a bad year.
We just had Heartbleed in April 2014.
Now we got shell shock popping up six months later.
This was a function that related to cgi scripts critical illness blah blah blah.
We'll dive into that a little bit bigger.
But basically shellshock was a vulnerability in bash not all types of shows but just bash.
So we'll just recap quickly.
Most Unique systems have multiple shows available went through this way back in the beginning of this
course and they all you know show sort of try to do some of the same thing.
They've got the command line interface allows you just essentially talk to code commands whatever you
trying to do.
And there's different ones right.
This dash the CSI set aside and then this bash now bash is the most common type of show that is pretty
pro violent.
Most systems use it by default.
It's a big one.
So when this critical vulnerability came out affecting bash it had a very widespread impact because
it was everywhere.
So it's jumpy in what is shellshock now to understand shellshock.
We've got to understand variables and functions and how they work behind the scenes.
So shellshock relates to these variables and functions and how they're passed to child processes.
Now we've gone through the bash scripting we know how to define a variable by var a cause and then whatever
string I want and then we call it with the dollar sign a function from similar approach is the function
name bracket bracket space curly bracket then the code to be run when the functions there if we want
to declare that function on the command line we'll use the declared command to create the function and
then we can just call it.
We don't actually have to put it inside a batch script.
We can do it all within the terminal that we've got.
So we've just demonstrated that really quickly even though the screenshots of their
so will create a variable
and then we can just type that code my ball and it prints all our world similar with the function
we've put that in there.
We'll now declare it so that it becomes a function.
It's just output of what the function code is.
And then we can just call it with food.
So instead of writing echoed my var or anything like that we can just call a function like that if we
try to echo that variable we get nothing back because it's a function not a variable.
So this if it defines the function Princess declaration runs the function deletes the function and then
confirms the function was deleted.
So if we don't want that function there anymore we'll just unset it and then when we call it there is
no function sitting behind the scenes.
So what is a child process then.
Well by default functions are not passed from the parent process to a child process and the parent process
is the regional thing running.
So in this case the parent process is bash and it had a variable and a function assigned to it.
Anything like call from within this batch terminal is the child process because it's being called by
my original terminal.
So in this case an off color coded it to make it nice and pretty for us but we can see here that I'm
executing Bash again some calling a bash show within a bash show.
So the second bash prompt is the child process of the COLA.
Now by default functions are not passed from the parent process to a child process.
That's because you might not want all of the privileges and functions and everything that you've got
running the new parent process to be available to the child.
It's a separation of privileges so that you just build that security so we've got a screenshot that
let's actually have a look at what's going on.
We're just going to create the function again.
It runs.
Now if we just call bash
and then talk for the command isn't found because we're now inside the child bash process even though
we can't sit here we exit we then return to the parent and we can call foo again and the function exists
so how do variables and functions get passed to child processes when they need to be.
There are two methods.
One is to pass it through the declaration
through exporting it.
So if we do export minus a third then called Bash again we can now type food.
There was nothing wrong with this method.
This method works fine.
It's the second method that had the issue.
Now the second issue was passing variables to child processes.
Here we create a show variable that looks very similar to a function but it's actually a variable Sierra.
We've done bar equals and then we've got the string of what would be a function.
Now it is not a function because when we run declare minus f we won't get anything.
It's a variable but it looks like a function.
So how does this thing get passed to the child process.
Well what people would do is they would put their actual functions inside a variable export the variable
to the child process and then declare the function.
So here we can see we've created the variable bar.
We've echoed it.
We've declared it we've exported it.
So we're saying how you give it to a child process.
We've called bash the child process.
When we echo the variable it's no longer a variable.
It's been turned into a function.
We run declare we can say that the function actually exists and if we talk bar it's you know the functions
code.
So what's happened here is that this variable in the parent process has turned into a function.
When the child process was code so there's obviously a conversion going behind the scenes there.
Because we started with a variable in the parent and ended up with a function in the child.
So what just happened.
How does this happen.
Well the parent we created a variable in the child Bash looks for functions denoted by the curly brackets
normal brackets even when it finds one it turns the variable into a function.
And this way pairing compost down a function to the child via a variable so you're not doing the export
a variable of functions anymore.
All you're doing is pumping a whole bunch of variables to a child process and you're keeping both variables
and functions depending on how the set up so this conversion process is something called pausing and
it was the pausing process which is where the show showed vulnerability existed so let's have a look.
Here is a screenshot of the actual vulnerability.
We've got a variable here page w Hello World and then I've added this extra little bit to the variable
it's still within the variable single quite single quote.
All of this is inside the variable but I've got the function declaration here and then I've just added
a little bit of extra code we print the variable we can see that that little extra echo extra is still
that we export it and then we call the child process and suddenly the word extra pops out.
We have a look at the variable in the child process not there.
Good.
I run the declared command say that it's been turned into a function run Hage W and it prints hello
world.
So the question is what happened up here.
Why did the word extra appear when we called our child process and this is the shell shocked vulnerability
extra was printed due to that error within the pausing conversion process when the child process started
it received all of the show variables it identified the shell variable and then passed the whole thing
as a variable to the function.
The vulnerability lied when we added that extra command at the end of the function.
This still gets executed as part of the processing parsing process and is what happened.
So looking at the screenshot again this is all variable.
We've exploded it we call it the pausing process begins it goes OK see I found a function will turn
H.W. into the function it just print Hello World and then we've got some extra command around here so
we'll run that as well
shellshock so let's dump into the source code let's actually have a look at why this happened again
looking at C have a little bit of an in-depth look this was the pausing process but a whole bunch of
characters of words and comments here and all that kind of stuff but the line we're really interested
in is this one this is the pausing process line if print mode equal zero and rape but don't execute
equal zero and string equal bracket bracket bracket bracket bracket strength for pause and execute execute.
All right let's make sense of this a little bit more so print mode equals equals zero.
That is a privileged checkoff of the functional variable being passed to the child process because you
don't want to pass sensitive functions to the child.
Security prevents privilege functions from being passed down raid but don't execute the second bit so
we've before I jump to that we've got this and command.
So all of these have to be true for this if statement to be executed.
If you think way back to when we went through the if then else statement you know when one had to equal
Harun by in this case proof might have steak was Iraq and rape but don't execute has today equal 0 and
the string equals these first four letters so rape don't execute it's in place to prevent rate only
functions being executed because obviously we've got pause and execute.
So we only want read function we want functions that are expected to be executed to be passed in this
process and then we've got this string a equal bracket bracket.
Curly bracket.
String forward line.
Now this is a pattern matching.
It's sort of like graph in a way we've got our pattern here and it's saying hey does the string equal
these four characters.
And this was how the bash source code would find functions.
It would look for variables that began with these four strings and go oh this is a function.
All right.
We now need to convert this into a function by parsing it and then executing it.
This is where the flaw is all it's doing is finding the beginning of the string.
There is no check for what's at the end.
It's just finding the beginning so when we added our extra echo extra command to the end of it this
was still put into it and taken as a whole and executed because there is no way.
As part of this if statement for the end of the function to be found
why was this such a big issue.
Oh we've really seen so far is this being executed on the command line with fascist code and if you've
already got a command line access why is this an issue.
Well if we can find a remote machine with a program that close bash and we can provide variables to
that program that's calling bash well then we can trigger the show show profitability.
So what's the service.
The whole purpose is to serve content to remote users Web services.
But what part of a web so CO's a trial bash process when you load Google is not running a batch process
behind the scenes.
So where do we actually find stuff that Coles bash CGI scripts so common Gateway interfaces.
These scripts are a really common way for web service to execute programs like console applications.
It was a way for the web server to cold bash to then run changes or programs or applications or whatever
behind the scene in an easy format.
Great use for this was it allowed web service to present dynamic pages that could change without actually
having to reload the entire page cgi scripts use bash to execute these programs were saved by the web
server and that's the attack back to here.
This is how shellshock became such a big issue.
So under the hood This looks like user sends a hasty shitty pay request to a web server web server loads
the page which has a CGI script in it.
The CGI script needs to run a bash command so it opens a child bash process and runs its command and
then loads it into the response given to the user.
But how well how can we use how can we give a variable to the web server to pass to the child curses.
So we're gonna have a look at all of the variables that the web service sends to the CGI script by default
here's a nice little list.
When a CGI script is code so which of these could be useful
you spotted it already.
The Hage TTP user agent the browser top of this visitor.
Now that is a client support supplied variable we define our user agent.
Normally crime of Firefox or whatever would define it for you but we are sending that user agent to
the web so here's a standard Hey CTP get request.
And here we can see that the user agent was already automatically included in the field and it's actually
spends a fair bit of information so it's telling Google in this case that I'm running on a Macintosh
I got OSX ten point twelve we got Gecko in that Firefox behind the scenes blah blah blah and the web
server can then fingerprint me from it.
So we've got our user agent we know what the attack is the user agent is used to inform the web server
of the type of browser we're using.
This is a value we control and it's passed to the CGI script.
So now what we have to do is pass exploit code as the user agent value and we will trigger the shell
show vulnerability.
I i.e. this line that we had down here at Echo hello world echo extra.
We want to input as our user agent and then call a vulnerable server.
So we'll just condense it a little bit because we've got some extra stuff here we don't want to pretty
hello world every time we might want to do something different than extra so we can just change the
echo change the extra bit to whatever command we want to run.
In this case it's just the day.
So it's like me typing all day here what's actually happening is when I type my day it's calling this
process heat slash uses slash been slash all day.
We don't have to type that every time because bashes environmental variables and path variables and
that's where it goes to to check whether it exists.
But that's where the actual executable lives.
We don't need this Hallowell bit.
We can just make an empty function.
Colin semicolon brackets semicolon.
So there we go.
Now we have our shortened exploit code to trigger the bit shell shocked vulnerability and now we just
need some way to execute it.
So again I've put a vulnerable Web server for shell shock on the done web box and its import 1004 and
the CGI script leaves at slash CGI Python been slashed Schuck made out CGI so how do we actually execute
this.
How do we do this.
Well we can do it with KO which is an inbuilt command into Linux and all it does is it makes a request
the same way.
Typing Google dot com into Firefox does so it's a command line the equivalent of your web browser for
example code shellshocked dot com is the equivalent of loading shellshock dot com or just give that
a second run navigate.
So it's printed all the hedge Timo code obviously because it's not a browser.
We're just getting the raw page him tags and everything like that when we input this into a browser
the browser knows how to understand those tags and create the images and the pages and all that kind
of stuff.
But if we actually look at the page source what we'll see is the same response that we show saw from
all Kirkham Kirkman Co.
So now we know how to make Web requests on the command line.
We know the web server we know the location we know the two and we know the exploit code.
Can you put it all together.
Follow along with me if you don't want to do it yourself and first thing we need to do is specify that
height to keep it user right.
Now if we talk man curl and go through the man pages scroll down a little bit we'll be able to see that's
the user agent
wherever it is.
Why bother scrolling through all that but the minus a command can be used to specify the user agent
that you won't code to use when talking to the web server.
So we've got code to command to run it.
We've got minus say and then whatever user agent we want this way when Ko makes the hate to to pay requests
the web server.
This will be the user agent that use
we've got curve.
We got my site and we're going to input that shellshocked command that we saw before to actually trigger
it.
So it was bracket bracket curly bracket colon seven column bracket semicolon.
And then we'll just do use it in our day this time.
Now wrap this all in quotes so that code knows when the user agent starts and ends then all we need
to do is code that vulnerable script
so I'm just going to log back into my box the web box we'll grab our IP address from a full on for five
I'm going to press control shift or which is gonna open up it's going to split the window into two different
terminals and I'll just make sure I can ping the box.
Yeah.
We were told it's on for 1004 so we'll just navigate to the page see if it works.
Code
takes it out of the.
So got co
and we're just gonna run the day come out we're gonna see who the web servers running as a say to pay
IP address of the Dawn web box at 1004 and then we were told that the script is under CGI bin slash
sucked me shock me dot CGI.
And this time instead of getting the hated him l code and the output of a web page we can see that the
shell shock vulnerabilities being executed and we've got the output of that vulnerability instead.
So we ran the use of being our day command and we got that we are the w w w data use of all the web
servers running the Web page as that user for changes to pay w day we're going to get much where it
pay w day live built in show.
All right if it's a built in show what we'll do is we'll just call bash and then say hey run that command
so echo slash bin slash bash modest safe command.
And this time we'll run paid up to date and to cope.
All right we're in slash use slash libs left CGI Bin.
Why don't we say what else is in this photo right.
Nothing else.
So you get the idea.
Now have achieved remote command execution on this Web server purely because this CGI script is calling
an out of date version of bash and we're triggering that shellshock vulnerability.
So that's cool we've got my command execution.
If it was a real user we could add a user opened up his stage get into the box itself or we can open
up what's called a reverse show now where this show is where we'll just like the page reversed.
Shell is where we've got say the terminal execution but it's being run on the other server.
But we've got that interactive show.
So imagine all these commands I was typing as if they were being run on the web server.
We want to trigger some code so that we load a terminal on our screen where all the commands are run
in the web server.
That's a reverse show a normal show is where you open up to show on the web server and then you connect
to it remotely and then you can run your commands whereas reverse is the show connects back to you so
there are a couple ways you can do this.
We could use net cap or we can do the Tacey P pipes so we know we're calling bash.
So what we can do is tell bash that instead of sending its output an input to the screen and reading
it from a keyboard.
Well why don't we send it across a network to us where we're listening so I'm going to press control
shift our I'm going to set up a net cat listen up pull one two three four.
We're then going to run the kill command enter in empty function and this time we're gonna call being
such bash in interactive mode and pipe everything into a tasty pay connection to us.
To do that we need to know our pay address restart the up so it's slash Dev slash take a pay slash IPA
slash port and now we need to redirect to standard input into this and the standard output into that
connection close off the user agent Cole the vulnerable page
hit enter and we can see here we've got a connection to us from the web server and we are running as
the WD data and we've got this remote show we've got the command prompt so now we can run paid a day
by day Ellis we can move around we can have a look at the web server we are executing commands as if
we were on that box and we've achieved OB remarks show and essentially are in the box now we're currently
in the W W W data user we're not rude and we'll go through some common Linux privilege escalation methods
later in this course
get the code right there for you if you need it and so in summary shellshock affected the bash show
it is the result of a weak variable to function conferred a process or pausing from parent to child
process and it is caused by only identifying the beginning of a function without checking where the
function ended.
This issue is widespread due to web servers using CGI scripts and spawning Bash shows all over the place
so you could just run that one command and get remote command execution on a web server almost anywhere.
Really big impact really big flaw but it was just that one simple line that triggered it all.