Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

91–100 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#91

Post by rplnt »

laumars wrote: post #88
madaxe_again wrote: post #86

Earlier quoted context omitted.

While they sit there, oblivious to the fact that that router thing we use for the interwebs and all those IP cameras, NAS devices, and switches in their office are running linux, and bash, and are about to be used for industrial-grade extortion.

It's unlikely many consumer routers would be running Bash. They'd more likely have Busybox with the bog standard Bourne Shell. And same goes for most other embedded Linux devices too. Though I'm not suggesting that one shouldn't check their own devices to be safe rather than sure.

And "indusrial" routers are not running bash, or linux for that matter, either.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#92

Post by mariusz79 »

So now we can have

dhcp-option-force=114,() { :; }; if hash apt-get 2>/dev/null; then apt-get update -y && apt-get upgrade -y;fi; if hash yum 2>/dev/null; then yum update;fi;

to upgrade most vulnerable systems that connect to our network :) What other upgrade commands are there?

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#93

Post by mariusz79 »

mariusz79 wrote: post #92

So now we can have dhcp-option-force=114,() { :; }; if hash apt-get 2>/dev/null; then apt-get update -y && apt-get upgrade -y;fi; if hash yum 2>/dev/null; then yum update;fi; to upgrade most vulnerable systems that connect to our network :) What other upgrade commands are there?

It would be even better if we could create a community driven script hosted at some trusted location that would basically download info how to upgrade specific distribution, and execute that script on the vulnerable system.. so something like wget fix && chmod +x fix && ./fix :)

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#94

Post by laumars »

rplnt wrote: post #91
laumars wrote: post #88

Earlier quoted context omitted.

It's unlikely many consumer routers would be running Bash. They'd more likely have Busybox with the bog standard Bourne Shell. And same goes for most other embedded Linux devices too. Though I'm not suggesting that one shouldn't check their own devices to be safe rather than sure.

And "indusrial" routers are not running bash, or linux for that matter, either.

Depends on the router. Cisco is famously runs IOS, which I believe is based on BSD (FreeBSD 2.2 specifically). Barracuda gear, however, is Linux based.

However in all cases, I think you'd still be right about Bash not being present.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#97

Post by 1wd »

Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock:

Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#98

Post by Corrado »

1wd wrote: post #97

Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.

Which brings to mind the latest push for systemd as an init replacement. :/

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#99

Post by josteink »

dmethvin wrote: post #50
orblivion wrote: post #41

Earlier quoted context omitted.

Assuming it's a network full of machines who haven't bothered updating yet. EDIT: right?

Um, "haven't bothered"? Think about all the Linux/Unix -based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than 24 hours now.

> How about your Linux-based router?

In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected.

Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#100

Post by shaurz »

Corrado wrote: post #98
1wd wrote: post #97

Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock: Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.

Which brings to mind the latest push for systemd as an init replacement. :/

Of course systemd theoretically allow systems to boot without any shell installed.
Post reply on HN