Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' scan of the Internet

blog.erratasec.com

Post reply on HN
Print view View original

11–20 of 42 posts

Re: Bash 'shellshock' scan of the Internet

#11

Post by zalzane »

gcr wrote: post #6
gojomo wrote: post #5

Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."

Who would grant `sudo` privileges to `www-data` without asking for a password? That's just asking for a bad time.

you could prolly get around that

if their httpd.conf has incorrect privs set, you could run a script that changes the "user to run as" to root, then set up a script that would run on next reboot to apt-get upgrade and remove the root privs config line. you'd have to wait for the server to go down or reboot however long in the future, but hey it would work.

Re: Bash 'shellshock' scan of the Internet

#12

Post by Mandatum »

NamTaf wrote: post #7
gojomo wrote: post #5

Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."

Does this qualify as white-hat or grey-hat hacking? Does the doing only good outweigh the bad of modifying someone else's system?

Relevant helpful viruses:

https://en.wikipedia.org/wiki/Welchia http://virus.wikidot.com/codered (CodeGreen)

Re: Bash 'shellshock' scan of the Internet

#13

Post by wcfields »

I see you!

209.126.230.72 - - [24/Sep/2014:15:04:17 -0700] "GET / HTTP/1.0" 200 62 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

209.126.230.72 - - [24/Sep/2014:17:14:58 -0700] "GET / HTTP/1.0" 200 62 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

Re: Bash 'shellshock' scan of the Internet

#16

Post by jackalope »

gojomo wrote: post #10
agwa wrote: post #2

I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"

Someone not wanting to stick out might only probe headers that are less-often logged, but still possibly passed-along as environment variables. Has anyone logged 'HTTP_FROM' in a long while?

The shellshock scan is setting the Host header, which might set the SERVER_NAME CGI variable in some environments and is not included in the Common Log Format or widely used Combined Log Format (which adds the Referer and User-Agent). For example, Apache's httpd directive UseCanonicalName is set to "off" by default, allowing the client to set SERVER_NAME via the Host header, possibly passing it to vulnerable scripts.

Furthermore, an admin might use directives to log the requested host in a name-based virtual hosting environment to facilitate parsing. For example, when using Apache's httpd LogFormat/CustomLog directives, if "%V" is used as the format string and UseCanonicalName is set to "off", the string provided by the client in the Host header will be written to the log. Naive parsers might choke on this or even execute the code. If the shellshock scan results in a delayed surge of pings from a single host, this is likely to be the cause.

Re: Bash 'shellshock' scan of the Internet

#17

Post by danielweber »

NamTaf wrote: post #7
gojomo wrote: post #5

Now, just to repeat the scan with: Referer: () { :; }; sudo apt-get update && sudo apt-get install --only-upgrade bash "Why, who was that masked sysadmin? We didn't even get the chance to thank him."

Does this qualify as white-hat or grey-hat hacking? Does the doing only good outweigh the bad of modifying someone else's system?

It's a long-running debate in the security community, almost as big as full-vs-responsible disclosure.

On the pro side, it's better than you get patched than stay vulnerable and fall into someone else's zombie list.

On the anti side, you don't know what you are messing with and could break things, oh, and it's illegal and you can go to jail.

On the anti-anti side, if you can't be held responsible to patch your machines, don't complain when someone else does it for you.

That's the barest summary.

Re: Bash 'shellshock' scan of the Internet

#18

Post by nwh »

thefreeman wrote: post #15

Not saying I agree with it, but personally I would be worried about prosecution from doing something like the scan he is doing.

Especially as it's actually executing code on other people's computers, you can't even really say it's just observation at that point.

Re: Bash 'shellshock' scan of the Internet

#19

Post by ilaksh »

To be vulnerable to this I need to be running CGI scripts right? I have my system set up with reverse nginx proxies and haproxy TCP mode pass through to things like nginx static files and Node.js servers. Can he run his ping command on my servers? I am thinking not.

Re: Bash 'shellshock' scan of the Internet

#20

Post by agwa »

mappu wrote: post #9
agwa wrote: post #2

I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"

I was scanned several times - looks like there were a few false starts and different ping commands: http://pastebin.com/badL7dtk

Ouch - that first attempt (ping without the -c option) has probably resulted in a number of long-lived ping processes.
Post reply on HN