Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

51–60 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#51

Post by lambda »

vibrolax wrote: post #31

FreeNAS (based on FreeBSD 9.2) has a vulnerable bash. I have 9.2.1.7.

The question is, does it call bash in its dhclient-script? I took a look through the FreeBSD source tree, and their version of dhclient-script uses /bin/sh. As long as /bin/sh is not bash (and that script doesn't in turn call any other bash scripts) it should be OK.

The best way to find out if you're vulnerable is by testing. It takes just a few minutes to set up dnsmasq to serve up an exploit. Here were my settings:

  interface=eth2
  dhcp-range=10.0.1.100,10.0.10.200,12h
  dhcp-option-force=114,() { :; }; echo "hi"
Of course, replace that 'echo "hi"' with the exploit of your choice. In my case, the output from dhclient would be printed on screen when restarting networking, so 'echo "hi"' was sufficient to verify that it was being executed.

If any bash scripts are called, with the environment variables that are set by dhclient, then that snippet should be run. If bash is not invoked, then that snippet won't ever run.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#52

Post by krek »

jeffmcjunkin wrote: post #15
akkartik wrote: post #10

Does this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?

This means that DHCP clients that use bash and have DHCP server-controlled environment variables can have commands injected (as root) by a malicious DHCP server. Notably, attackers in an unhardened network can reply to DHCP clients themselves, even if there's already a DHCP server on the network. So it's not just the sysadmin who can exploit this, but anyone on the same network (broadcast domain) as the vulnerable DH…

This is best plain English explanation I've seen yet (been looking for an hour). Thanks.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#53

Post by vibrolax »

masklinn wrote: post #33
vibrolax wrote: post #31

FreeNAS (based on FreeBSD 9.2) has a vulnerable bash. I have 9.2.1.7.

FreeNAS doesn't use bash as /bin/sh by default or as root shell unless you've set it yourself (which some users do: http://forums.freenas.org/index.php?threads/replacing-standa... )

Yes. In this thread: http://forums.freenas.org/index.php?threads/its-bashs-turn-t... a user speculates that bash is included only for user convenience. I didn't know if repeating this speculation was HN-worthy, so I only reported what I knew for fact.

The following indicates than a patched bash is forthcoming: http://lists.freenas.org/pipermail/freenas-commit/2014-Septe...

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#54

Post by dfc »

exploit wrote: post #43

I've tried to replay this attack in VM environment using Debian, but no luck. option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow" or option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow"; not working. dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP…

How do you have dash/bash setup:

  # debconf-show dash
  * dash/sh: true
true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#55

Post by dfc »

Maken wrote: post #24
danielweber wrote: post #21

Earlier quoted context omitted.

Does NetworkManager completely obviate the need for the DHCP binary to call shell scripts? Those scripts often exist because if the sysadmin needs something special to happen on DHCP, this is where he sets it. It's not "DHCP scripts get run by/are shell scripts," it's "DHCP binaries are prepared to call out to external scripts." I've had to write these shell scripts (using ksh, since OpenBSD, so those are safe).

Well, Network Manager for starters is a binary and not a shell script like the dhclient-script.

Network manager depends on "the dhclient-script."

  > A variety of other system services are used by NetworkManager
  > to provide  network functionality wpasupplicant  for wireless
  > connections  and 8021x  wired  connections pppd  for PPP  and
  > mobile  broadband connections  DHCP  clients  for dynamic  IP
  > addressing
http://cgit.freedesktop.org/NetworkManager/NetworkManager/tr...

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#58

Post by ladzoppelin »

dubfan wrote: post #46
mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

Given the rate at which QNAP issues updates I'm not expecting it to be fixed for at least another month, and that will most likely be a beta release. I like my QNAP NAS but I don't think I'd buy another QNAP product. They are just too unresponsive to these sorts of things.

Is it possible to update bash on the QNAP? I know you can install an SVN server using Optware IPKG but would this work with the updated Bash? These QNAPs do way to many things with barely any software updates. Its a disaster waiting to happen.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#59

Post by tacoman »

dharma1 wrote: post #16
mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

just ssh'd into my WD mycloud.. yep it's vulnerable WDMyCloud:~# ls -l /bin/sh lrwxrwxrwx 1 root root 4 Jun 30 08:38 /bin/sh -> bash

There are a bunch of daemons running on a fully configured My Cloud. I haven't had much success in finding anything yet, but yeah, it has the bug.

  nas:~# bash --version | head -1
  GNU bash, version 4.2.37(1)-release (arm-unknown-linux-gnueabihf)
  nas:~# uname -a
  Linux nas 3.2.26 #1 SMP Tue Jun 17 15:53:22 PDT 2014 wd-2.2-rel armv7l GNU/Linux
  nas:~# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
  vulnerable
  this is a test
EDIT: formatting.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#60

Post by schwag09 »

exploit wrote: post #48
schwag09 wrote: post #42

I created a python + scapy poc: https://github.com/mschwager/shellshock_poc I tested it with my laptop and android phone on my wifi network.

So could you get a root shell (on linux laptop)?

Unfortunately my poc isn't working as expected. I'll continue investigating, and keep the repo up to date.

Feel free to fork it and use it as a place to start for your own poc.

Post reply on HN