Welcome back.
It is time that we cover our first vulnerability in a website and as a first vulnerability, I've chosen
to show you the shellshock exploitation.
Now, shellshock is an older vulnerability, it was discovered in 2014, and you will most likely never
find it today while performing penetration tests.
But nonetheless, I want to show it to you just because of the impact that it had, Shellshock is considered
one of the most critical and serious vulnerabilities ever discovered.
This vulnerability occurred due to bash differently processing environmental variables.
With this, many things were hit from the clients, from terminal command lines to CGI scripts inside
of Web applications.
And in this tutorial, we will see an example of exploiting shell shock through the CGI script on a
Web page.
Also for this, we're going to download a small ISO file that will allow us to run a virtual machine
only for this vulnerability.
Don't worry, it'll only take a few seconds to install due to being a small virtual machine, and it
is only purposely designed for this specific vulnerability.
To download it, you want to go to your Google, you can type in pen tester, lab shellshock and you
should see a link like this that says CVT 2014 six to seven one called Shellshock.
It will be from the pen tester lab dot com.
And you want to click on it and it will never get you to this page right here where you will have the
shell shock, introduction, fingerprinting and all the other stuff regarding this vulnerability.
However, we're not going to go into these details right here because we want to exploit it ourselves.
What we want to do is we want to go to the files right here.
And you should see this ISO where you want to click on it and it will download the ISO image with the
size of nineteen point one megabytes.
So you can see it is really, really small.
Once you do that, you want to go to your virtual box and you want to create a virtual machine, as
we usually do.
Now, I already got shell shock lab created with the ISO file that we just downloaded.
But what you essentially want to do is you want to click on you, then you can call it anything you
want.
You can call it shell shock.
You can select right here Linux as an operating system.
And the version of Linux is going to be other Linux, 32 bit.
Click on that, then you can proceed to next.
You can leave it to two hundred and fifty six megabytes of RAM.
That is more than enough for this machine.
Click on next right here.
We want to create a virtual machine next here next year as well.
And we can click on create.
And as usual, there are two more things that we want to do once we create a new virtual machine, we
want to navigate to the settings from the settings.
We want to go to network, switch from Beñat to Bridgid adapter, select your adapter right here.
And another thing that you want to do is we want to add our ISO file.
So delete this empty right here.
Click on the disc icon, click on Add and find the ISO file in my case, here it is CV 2014 six to seven
one click on Choose and click on.
OK, this will create your shellshock virtual machine.
After you do that, you want to go to your clinics, start your burps at all that we covered already,
that we covered the configuration of and you want to go start it up, and after you start it up, you
can open your Firefox.
Now, you might have noticed if you tried before watching this video that once you tried to visit Firefox
without having Burset running, you will not be able to visit any page.
And that is because we set our site to be a proxy for our Firefox.
So now every time you want to visit Firefox page or any website page, you must have Burset open and
you must also have the intercept turned off so it doesn't intercept any packets.
Otherwise your page will just load forever.
Now that we opened the Firefox, let us open to it is starting the project and as soon as it opens up,
we will be able to visit our page on our Shellshock virtual machine.
OK, so now the burps it opened, go to Target, then go to proxy and turn off the intercept right here.
So intercept should be off.
Once you do that, the next thing that we want to do is we want to start our shellshock virtual machine.
If you're starting it for the first time, it should only take a few seconds to set everything up,
since it is a really, really small virtual machine.
And once it opens up, it won't even prompt you for a login.
There is no login available inside of this machine right here.
It will just enter the command line where we want to type of conflict just to find out the IP address
of this machine and in this case it is 192 that 168 at one to 10.
So all we want to do is we want to go to our Firefox and visit this page to see what we have.
And this seems to be the entire page of this virtual machine we get, this system is running the time
that it is running currently for zero minutes because we just started it up and we get the kernel of
that virtual machine.
Now, if we take a look at our berp suit right now and we go to the targets and we go to our IP address
of the shell shock virtual machine, we will see all the links that we requested once trying to up the
Web page of our shell shock virtual machine.
We will see this directory.
We will see this JavaScript file and we will see this CGI pin status directory.
So we get a CGI script right here.
If we go to the response of that request that we sent.
And to do that, you simply just select the request that you want to go to and click on response right
here.
Then we will sit down here.
This output that looks a lot like an output to the command.
You name Dash eight, for example.
If you run the command, you name Dash eight inside of your terminal, it will give you an output like
this, which will tell you which version of Linux are you running and so on and so on.
We get a similar output inside of our burps, as we can see right here.
And in most cases, this output is run by the unnamed I command and it is run by Basche and inside this
request that we did user agent field that we got inside of the request is an environmental variable
when processed inside of this CGI script.
So what we can try is to inject the command in that field.
However, it won't work that easy.
We can just inject, for example, who am I command instead of this, it will not give us any output
back.
You might be asking why?
Well, because shell shock vulnerability is based on first specifying an empty function.
And I know this might sound confusing, but just stick with me for a couple more minutes and I will
explain it how it works.
The vulnerability itself was discovered when inside of an environmental variables such as this user
agent, empty function syntax was specified and empty function syntax looks something like this.
Let me show you inside the terminal, it is this set of characters to open bracket, close bracket and
space, open curly bracket CDN space to dot, dot and comma and closed curly bracket and at the end
another dot and comma.
And this right here is a syntax for an empty function.
So any command that we want to run before it, we must have this empty function syntax y.
Well when Besch gets these characters in this order, or if Bush gets these empty function with the
variable instead of blocking it, it will accept it with a variable that comes after and it runs it
as a command on the server.
And that is the entire vulnerability.
All we have to do is specify a command after the syntax and it should work.
Now, to do that, we must send this HTP request right here to this CGI script once again, and we must
specify, instead of the user agent, the empty function syntax and then our command.
So how can we do that?
How can we send the request once again?
Well, luckily it allows us to edit our requests and send them as many times as we want.
All we need to do is to select the request that we want to send again.
So we select it right here.
Then we write click and send to repeater right here.
Then you will see this repeater part light up.
We want to go there and here.
We can edit our request before actually sending it.
So we mentioned that we want to inject the command inside of the user agent field.
Let us remove this.
And let's type the syntax for the anti function first, so open and closed bracket, that empty space,
open curly bracket, then space, two dots, comma and dot, close curly bracket and comma and dot at
the end.
Now, what you can do after this is you can inject your comment and if you want to, you can test to
see if it works with the ping command first.
But I'm not going to test it with the ping command.
I'm going to straightaway try to establish a connection with our Kalinda's machine and get our reverse
channel back.
So what do we want to do right here to establish a connection with our killing machine?
Well, we want to execute bin Bash and this will tell the target to execute the following comment.
If we specify Desh see after, it will tell our target that whatever we send after this will be our
command and we must specify between the single quotes.
So for now we have the empty function syntax, then bin bash, bash see, then open single quotes and
closing quotes and in between the quotes we type and see which stands for Netcare and we specify the
IP address of our Calientes machine.
So let's check it out right here.
So I have config test.
One, two, three, four is my password and I will specify 182.
That 168.
That one, that nine.
So right here one add to that 168, that one dot nine.
And I want to specify also the port to connect to.
In my case I will use port one, two, three, four, five.
It doesn't really matter.
And at the end we want to specify Desh E, which stands for what we want to execute on our target machine.
And we want to simply just use the shell so we can do that by specifying slash and slash Besch.
And this is the entire comment about Cupitt to my terminal so you can see it enlarged.
So Copi and if I can clear the screen paste it's right here.
This is our entire comment, the empty function syntax and then the function that allows us to establish
a connection to our Caledonius machine.
But before we send this request from our Burset, we must set up a listener right here.
So I'm just going to go and type and see AVP.
And then on the part that we specified, which is one, two, three, four, five, press enter this
will listen for the incoming connections.
And now that we change the user agent feel to our command, we can click on send.
If I go back to our clinic's terminal, we can see if we got the connection from our Shellshock virtual
machine and if we tried to execute commands such as Who am I?
All of that will work.
We can see if we are dependent.
The lab, the command will give me all the directories inside of the current directory.
I can type to check out my current working directory and I am in this bar sledged w w w CGI dash bin
folder.
Great.
So we successfully exploited this shell shock vulnerability and gained access to this machine.
Now you can also automate this entire process with metal plate framework.
So what we did right here is we manually exploited the target with the help of a Burset.
We sent our request for the CGI script to the repeater.
Then we changed the user field to our command, which requires the empty syntax at the beginning and
after it, the command that we want to execute, which can be any command that you really want.
Then we set up a listener inside of our terminal and we sent this packet once again or we sent this
request once again.
Right here we can see the response to this request and it tells us that we got the internal server error
because it doesn't really recognize this user agent.
However, it did execute this command, which is all that we want inside of the metabolite framework.
You can type search shellshock.
And you can use this exploit right here, which is exploit multi HTP, Apache mode, CGI, Besch, environmental
execution, you can copy that type of use and then paste this election.
It will set our payload to be Linux X 86 Metropia to reverse DCB and if I type show options.
I can set my options right here.
So what I must set is the our hosts, which is the IP address or my target machine.
Let's do that first.
But I also must said, is this our path?
So this will be the path to the CGI script.
So the our path must be set to CGI dash bin status, if I'm not mistaken.
That is the path let us see inside of our website.
So it indeed is CGI bin and then status and all we are left to do right now is set this and run our
exploit.
Oh pardon me.
It's not there.
Let's just go and set the target.
You're right.
It is target.
You are right that we must set to be the CGI bin status.
So let's just set the target right instead.
And let's set the our path back to Spain, I believe, and let's give this a try.
We send this if we get them a therapy session, one opened.
And here it is to get user ID will tell us who we are, we can execute the commands and we can do everything
that we did inside of our exploitation section.
So we successfully exploited shellshock vulnerability in two different ways manually by using it and
sending over command in the user agent field and with the help of this metal plate framework module.
It also exploited the user agent field.
As we can see right here.
We told the path to be CGI in status and we got the interpreter reverse shellback.
Great.
Now that we did this in the next video, we are going to check out a very similar thing to this, which
is called command injection scene with the next video.