Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

11–20 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#11

Post by arielby »

jeffmcjunkin wrote: post #2

Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time. A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability. [1] http://linux.die.net/man/…

Note that if you try to do the exploit via the hostname or another common option, the CVE-2011-0997 fix will stop you. However, the fix is incomplete - it does not check all options, only the ones the old CVE's fixers thought of.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#12

Post by mr_brown »

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#14

Post by kbar13 »

Klasiaster wrote: post #13

one more reason for networking done by network-manager or networkd (systemd) instead of bash scripts

that's some straw man you got there.

Just because bash is vulnerable in this case doesn't mean that networkd/network-manager will never be vulnerable.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#15

Post by jeffmcjunkin »

akkartik wrote: post #10

Does this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?

This means that DHCP clients that use bash and have DHCP server-controlled environment variables can have commands injected (as root) by a malicious DHCP server.

Notably, attackers in an unhardened network can reply to DHCP clients themselves, even if there's already a DHCP server on the network. So it's not just the sysadmin who can exploit this, but anyone on the same network (broadcast domain) as the vulnerable DHCP client.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#16

Post by dharma1 »

mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

just ssh'd into my WD mycloud.. yep it's vulnerable

WDMyCloud:~# ls -l /bin/sh lrwxrwxrwx 1 root root 4 Jun 30 08:38 /bin/sh -> bash

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#17

Post by akkartik »

jeffmcjunkin wrote: post #15
akkartik wrote: post #10

Does this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?

This means that DHCP clients that use bash and have DHCP server-controlled environment variables can have commands injected (as root) by a malicious DHCP server. Notably, attackers in an unhardened network can reply to DHCP clients themselves, even if there's already a DHCP server on the network. So it's not just the sysadmin who can exploit this, but anyone on the same network (broadcast domain) as the vulnerable DH…

Alright, I'm shutting down my cable modem. See y'all later.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#18

Post by Sanddancer »

Klasiaster wrote: post #13

one more reason for networking done by network-manager or networkd (systemd) instead of bash scripts

NetworkManager's had vulnerabilities over the years ( http://www.cvedetails.com/product/5634/Gnome-Networkmanager.... ), as has systemd. Stating this as a reason to switch is ridiculous. One can easily switch to a much more audited, secure scripting environment, such as ksh, and still have all the power scripting brings.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#20

Post by syshax »

mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

Just FYI to other owners:

Synology DSM 5.0-4493 Update 5 here: it uses busybox, so not vulnerable.

    synology> which bash
    synology> which sh
    /bin/sh
    synology> which ash
    /bin/ash
    synology> ls -l /bin/sh
    lrwxrwxrwx    1 root     root             7 Jun  5 11:27 /bin/sh -> busybox
    synology> ls -l /bin/ash
    lrwxrwxrwx    1 root     root             7 Jun  5 11:27 /bin/ash -> busybox
Post reply on HN