Shellshock DHCP Remote Code Execution – Proof of Concept
trustedsec.com
Shellshock DHCP Remote Code Execution – Proof of Concept
1–10 of 160 posts
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#2Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time.
A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability.
[1] http://linux.die.net/man/5/dhcpd-options (search for "dhcp-parameter-request-list")
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#3Thanks for the info.
Has anyone tried this with an OS X client to see if it behaves like the Linux system in the article? I know OS X bash is vulnerable to the exploit, but I don't know if their DHCP system handles environment variables in an exploitable way.
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#4Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time. A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability. [1] http://linux.die.net/man/…
Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#5I was going to do this this evening and now he's saved me the time. Thanks! :)
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#6Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time. A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability. [1] http://linux.die.net/man/…
Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.
Are smaller shells like busybox affected though? I bet a lot of routers run it (I know mine with OpenWRT does).
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#7Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time. A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability. [1] http://linux.die.net/man/…
Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.
Very true. To be clear to other readers, busybox is more common in smaller embedded devices, though today's AlienVault blog post [1] showed that Mitel VoIP systems (which use Debian/ARM, if I recall) use bash and are vulnerable.
[1] http://www.alienvault.com/open-threat-exchange/blog/attacker...
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#8Earlier quoted context omitted.
Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.
Are smaller shells like busybox affected though? I bet a lot of routers run it (I know mine with OpenWRT does).
No, busybox is not affected.
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#9Thanks for the info. Has anyone tried this with an OS X client to see if it behaves like the Linux system in the article? I know OS X bash is vulnerable to the exploit, but I don't know if their DHCP system handles environment variables in an exploitable way.
OS X doesn't use Bash for configuring DHCP, so it's not vulnerable. All of that is done in the kernel on Macs.
Re: Shellshock DHCP Remote Code Execution – Proof of Concept
#10Does this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?