Welcome back.
It is time that we cover our first vulnerability in a website and as the first vulnerability, I've
chosen to show you the shellshock exploitation.
Now Shellshock is an older vulnerability.
It was discovered in 2014 and you will most likely never find it today while performing penetration
tests.
But nonetheless, I want to show it to you just because of the impact that it had.
Shellshock is considered one of the most critical and serious vulnerabilities ever discovered.
This vulnerability occurred due to patch differently processing environmental variables.
With this, many things were hit from the HTTP clients, from terminal command lines to CGI scripts
inside of a web applications.
And in this tutorial we will see an example of exploiting shell shock through the CGI script on a web
page.
Also for this, we are going to download a small ISO file that will allow us to run a virtual machine
only for this vulnerability.
Don't worry, it will only take a few seconds to install.
Due to being a small virtual machine and it is only purposely designed for this specific vulnerability.
To download it.
You want to go to your Google, you can type in pen tester, lab shellshock, and you should see a link
like this that says CVE 2014 6271 called Shell Shock.
It will be from the pen tester lab dot com and you want to click on it and it will navigate you to this
page right here where you will have the shellshock introduction, fingerprinting and all the other stuff
regarding this vulnerability.
However, we're not going to go into these details right here because we want to exploit it ourselves.
What we want to do is we want to go to the files right here, and you should see this ISO where you
want to click on it and it will download the ISO image with the size of 19.1 megabytes.
So you can see it is really, really small.
Once you do that, you want to go to your VirtualBox box and you want to create a virtual machine,
as we usually do.
Now, I already got shell shock lab created with the ISO file that we just downloaded, but what you
essentially want to do is you want to click on New.
Then you can call it anything you want.
You can call it shellshock.
You can select right here Linux as an operating system.
And the version of Linux is going to be other Linux 32 bit.
Click on that.
Then you can proceed to next.
You can leave it to 256 megabytes of RAM.
That is more than enough for this machine.
Click on next right here.
We want to create a virtual machine next here.
Next here as well.
And we can click on Create.
And as usual, there are two more things that we want to do.
Once we create a new virtual machine, we want to navigate to the settings.
From the settings, we want to go to network, switch from the net to bridged adapter, select your
adapter right here.
And another thing that we want to do is we want to add our ISO file.
So delete this empty right here.
Click on the disk icon.
Click on Add and find the ISO file.
In my case, here it is.
CV 2014 6271.
Click on Choose and click on OC.
This will create your shellshock virtual machine.
After you do that, you want to go to your clinics, start your BRB search tool that we covered already,
that we covered the configuration of, and you want to go start it up and after you start it up you
can open your Firefox.
Now you might have noticed if you tried before watching this video that once you try to visit Firefox
without having it running, you will not be able to visit any page.
And that is because we set our website to be a proxy for our Firefox.
So now every time you want to visit Firefox page or any website page, you must have burst open and
you must also have the intercept turned off so it doesn't intercept any packets.
Otherwise your page will just load forever.
Now that we opened the Firefox let us open it to it is starting the project and as soon as it opens
up we will be able to visit our page on our shell shock virtual machine.
Okay, so now that it opened.
Go to Target, then go to Proxy and turn off the intercept right here.
So Intercept should be off.
Once you do that, the next thing that we want to do is we want to start our shell shock virtual machine.
If you're starting it for the first time, it should only take a few seconds to set everything up since
it is a really, really small virtual machine.
And once it opens up, it won't even prompt you for a login.
There is no login available inside of this machine right here.
It will just enter the command line where we want to type of config just to find out the IP address
of this machine.
And in this case it is one IP to that one, 6 to 8, that 1 to 10.
So all we want to do is we want to go to our Firefox and visit this page to see what we have.
And this seems to be the entire page of this virtual machine we get.
This system is running the time that it is running currently for 0 minutes because we just started it
up and we get the kernel of that virtual machine.
Now, if we take a look at our burp suit right now and we go to the targets and we go to our IP address
of the shell shock virtual machine, we will see all the links that we requested once trying to open
the web page of our shell shock virtual machine.
We will see this slash directory, we will see this JavaScript file and we will see this CGI bin status
directory.
So we get a CGI script right here.
If we go to the response of that request that we sent and to do that, you simply just select the request
that you want to go to and click on response right here.
Then we will see down here this output that looks a lot like an output to the command you name dash
a for example, if you run the command, you name dash A inside your terminal, it will give you an
output like this which will tell you which version of Linux are you running, and so on and so on.
We get a similar output inside of our burp suit, as we can see right here.
And in most cases this output is run by the unnamed I command and it is run by bash.
And inside this request that we did, User Agent Field that we got inside of the request is an environmental
variable when processed inside of this CGI script.
So what we can try is to inject the command in that field.
However, it won't work that easy.
We can just inject, for example, who am I command instead of this?
It will not give us any output back.
You might be asking why?
Well, because shellshock vulnerability is based on first specifying an empty function.
And I know this might sound confusing, but just stick with me for a couple more minutes and I will
explain it how it works.
The vulnerability itself was discovered when inside of an environmental variable such as this user agent
empty function syntax was specified and empty function syntax looks something like this.
Let me show you.
Inside the terminal it is this set of characters.
So open bracket, close bracket, then space open curly bracket, then space to dots dot and comma and
closed curly bracket and at the end another dot and comma.
And this right here is a syntax for an empty function.
So any command that we want to run before it, we must have this empty function syntax.
Why?
Well, when Bash gets these characters in this order, or if Bash gets this empty function with the
variable instead of blocking it, it will accept it with the variable that comes after and it runs it
as a command on the server.
And that is the entire vulnerability.
All we have to do is specify a command after the syntax and it should work.
Now to do that we must send this HTTP request right here to this CGI bean script once again.
And we must specify, instead of the user agent, the empty function syntax and then our command.
So how can we do that?
How can we send the request once again.
Well, luckily brb.
So it allows us to edit our requests and send them as many times as we want.
All we need to do is to select the request that we want to send again.
So we select it right here.
Then we right click and send to repeater right here.
Then you will see this repeated part light up.
We want to go there and here we can edit our request before actually sending it.
So we mentioned that we want to inject the command inside of the user agent field.
Let us remove this.
And let's type the syntax for the empty function first.
So open and closed bracket, then empty space, open curly bracket, then space two dots comma and dot
close curly bracket and comma and dot at the end.
Now what you can do after this is you can inject your command and if you want to, you can test to see
if it works with the ping command first.
But I'm not going to test it with the ping command.
I'm going to straightaway try to establish a connection with our Kleenex machine and get a reverse shell
back.
So what do we want to do right here to establish a connection with our clinic's machine?
Well, we want to execute slash bin slash bash, and this will tell the target to execute the following
command.
If we specify dash, see after, it will tell our target that whatever we send after this will be our
command, and we must specify it between the single quotes.
So for now we have the empty function syntax, then slash bin, slash bash, bash C, then open single
quotes and close single quotes.
And in between the quotes we type and C which stands for Net Cat and we specify the IP address of our
clinic's machine.
So let's check it out right here.
Pseudo IV config test.
One, two, three, four is my password and I will specify 182.168.1.9.
So right here, 182.168.1.9.
And I want to specify also the port to connect to.
In my case, I will use port one, two, three, four, five.
It doesn't really matter.
And at the end we want to specify Dash E, which stands for what we want to execute on our target machine.
And we want to simply just use the bash shell so we can do that by specifying slash bin and slash bash.
And this is the entire command I will copied to my terminal so you can see it enlarged.
So copy.
And if I clear the screen, paste it right here.
This is our entire command, the empty function syntax, and then the function that allows us to establish
a connection to our kalanick's machine.
But before we send this request from our burp suit, we must set up a listener right here.
So I'm just going to go and type and see LVP.
And then on the port that we specified, which is one, two, three, four, five.
Press enter.
This will listen for the incoming connections.
And now that we change the user agent field to our command, we can click on Send.
If I go back to our clinics terminal, we can see we got the connection from our shellshock virtual
machine.
And if I try to execute command, such as who am I?
All of that will work.
We can see we are the pen tester lab.
The RLS command will give me all the directories inside of the current directory.
I can type the p wd to check out my current working directory and I'm in this slash bar slash w ww slash
cgi dash bin folder.
Great.
So we successfully exploited the shellshock vulnerability and gained access to this machine.
Now you can also automate this entire process with Metasploit framework.
So what we did right here is we manually exploited the target with the help of a burp suit.
We sent our request for the CGI bean script to the repeater.
Then we changed the user field to our command, which requires the empty syntax at the beginning and
after it the command that we want to execute, which can be any command that you really want.
Then we set up a listener inside of our terminal and we sent this packet once again, or we send this
request once again right here we can see the response to this request and it tells us that we got the
internal server error because it doesn't really recognize this user agent.
However, it did execute this command, which is all that we want inside of the Metasploit framework.
You can type search shellshock.
And you can use this exploit right here, which is exploit multi HTTP.
Apache mode CGI bash environmental execution.
You can copy that type use and then paste the selection.
It will set our payload to be Linux x86 method, reverse TCP and if I type show options.
I can set my options right here.
So what I must set is the our hosts, which is the IP address on my target machine.
Let's do that first.
What I also must set is this our path.
So this will be the path to the CGI script.
So the path must be set to CGI dash bin slash status.
If I'm not mistaken, that is the path let us see inside of our burp suit.
So it indeed is CGI bin and then status and all we are left to do right now is set this and run our
exploit.
So.
Oh, pardon me.
It's not there.
Let us just go and set the target.
You are right, it is target.
You are right that we must set to be the CGI bin status.
So let's just set the target.
You are right instead.
And let's set the path back to slash pin, I believe, and let's give this a try.
We send this we get them a therapy session.
One opened.
And here it is.
Get user ID will tell us who we are.
We can execute the commands and we can do everything that we did inside of our exploitation section.
So we successfully exploited shellshock vulnerability into different ways manually by using burp suit
and sending our command in the user agent field.
And with the help of this Metasploit framework module, it also exploited the user agent field, as
we can see right here.
We told the path to be CGI bin status and we got the reverse shell back.
Great.
Now that we did this in the next video, we're going to check out a very similar thing to this, which
is called command injection.
See the next video.