Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

71–80 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#71

Post by pjmlp »

ams6110 wrote: post #62
hardwaresofton wrote: post #35

Yeah, I don't think anyone has grasped the extent of how dangerous this vuln is -- was it released a little prematurely? is it still in "embargo"? This is hundreds of times worse than heartbleed in terms of scope/attack surface for modern servers... (I say hundreds of times worse because heartbleed was scrape-some-data-till-you-get-private-keys-and-watch-communication, where this is just get-yourself-a-shell-and-pwn-…

On the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.

I guess it is the hard way for some people to learn that they aren't safe just because they use UNIX systems vs Windows.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#72

Post by hardwaresofton »

lbruder wrote: post #67
ams6110 wrote: post #62

Earlier quoted context omitted.

On the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.

While not exactly thrilled, as a Linux user I have to admit it's only fair. That's exactly what some of us did all those years when Windows used to have more holes than Linux. Ah well, back to BSD I guess...

Hmnn well I wonder just how much safer BSD is compared to Linux...

I would consider linux to have more eyes on it, and if I remember correctly, LibreSSL was not infallible (despite all the shaming of OpenSSL folks that went on)

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#73

Post by hardwaresofton »

pjmlp wrote: post #71
ams6110 wrote: post #62

Earlier quoted context omitted.

On the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.

I guess it is the hard way for some people to learn that they aren't safe just because they use UNIX systems vs Windows.

Apple is just about the only company that really benefits from that misconception (possibly by virtue of the fact that there's not really a "linux" company, though Canonical is trying)

I wonder if it would be a reach to say that the average mac user (though when I think about it, a disproportionate amount of those users are probably devs) will hear about this on the news, and assume Apple has their back (which they do, I'm sure they'll force a patch soon if they haven't already) and not even know there's a UNIX system down there

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#74

Post by bostik »

hyperbovine wrote: post #68

curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash Let's hope that script does what it claims to do :)

Even if that was meant as a joke, I do hope you realise the irony.

To protect against running untrusted code in a shell, you ... run code from an untrusted source in the shell. As root.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#75

Post by [deleted] »

hardwaresofton wrote: post #72
lbruder wrote: post #67

Earlier quoted context omitted.

While not exactly thrilled, as a Linux user I have to admit it's only fair. That's exactly what some of us did all those years when Windows used to have more holes than Linux. Ah well, back to BSD I guess...

Hmnn well I wonder just how much safer BSD is compared to Linux... I would consider linux to have more eyes on it, and if I remember correctly, LibreSSL was not infallible (despite all the shaming of OpenSSL folks that went on)

[deleted]

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#76

Post by zurn »

So is the default dhclient conf vulnerable in any of the Linux distributions using bash for /bin/sh (eg CentOS/Fedora)?

edit: According to one poster on Stackexchange, Debian/Ubuntu may be vulerable despite not having bash for /bin/sh: "What's more, on Debian (and possibly many of its myriads of offsprings like Ubuntu), which uses dash as /bin/sh, dhclient-script is explicitely shebanged to /bin/bash, and it does seem to contain a bashism, too" (https://security.stackexchange.com/questions/68156/is-connec...)

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#77

Post by hyperbovine »

bostik wrote: post #74
hyperbovine wrote: post #68

curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash Let's hope that script does what it claims to do :)

Even if that was meant as a joke, I do hope you realise the irony. To protect against running untrusted code in a shell, you ... run code from an untrusted source in the shell. As root.

Yes :-)

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#78

Post by bx_ »

iLoch wrote: post #32

I think one of the things Heartbleed PoCs did really well was show the result for the end user. Most people aren't going to know what any of this stuff means. Can we come up with a really straight forward explanation in laymans terms as to what this means for the average Internet user?

http://shellshock.co.za/

i thought this was pretty straightforward

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#79

Post by dfc »

takeda wrote: post #69
ams6110 wrote: post #62

Earlier quoted context omitted.

On the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.

It's mostly Linux issue because bash is there installed by default and even /bin/sh is really bash... For example on BSD you could technically install bash, but chances that it is used as a shell for a services is very small.

Debian's default /bin/sh is not "really bash," it is dash. The same is true for many embedded distros based on busybox.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#80

Post by dfc »

hardwaresofton wrote: post #73
pjmlp wrote: post #71

Earlier quoted context omitted.

I guess it is the hard way for some people to learn that they aren't safe just because they use UNIX systems vs Windows.

Apple is just about the only company that really benefits from that misconception (possibly by virtue of the fact that there's not really a "linux" company, though Canonical is trying) I wonder if it would be a reach to say that the average mac user (though when I think about it, a disproportionate amount of those users are probably devs) will hear about this on the news, and assume Apple has their back (which they d…

Redhat is "really a 'linux' company."
Post reply on HN