Re: [Haifux] The Bash vulnerability (shellshock)
Thanks Guy. I'll definitely try one of those test scripts. As for asking a random site to check this for me -- I'm not sure it's a good idea. I mean, I don't know who has set up this site and what their intentions are... Regards, Eli On 27/09/14 22:42, Guy Edri wrote: Hey Eli. http://www.tripwire.com/state-of-security/off-topic/shell-shocked-bash-bug-detection-tools-cve-2014-6271/ http://shellshocktest.com/ https://github.com/mubix/shellshocker-pocs enjoy your PT with all those tools. -- Web: http://www.billauer.co.il ___ Haifux mailing list Haifux@haifux.org http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
you need to find a vulnerable site. CGI doesn't have to pass through bash.
you need a site that opens a subshell for something. they aren't uncommon,
but it's not every linux-CGI site.
On Fri, Sep 26, 2014 at 2:33 PM, Eli Billauer e...@billauer.co.il wrote:
Hi,
I did
# yum upgrade bash
on Haifux' server, and it's off the hook. But I was also surprised that it
the attack failed even before that.
Eli
On 26/09/14 12:39, guy keren wrote:
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
--guy
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
--
Web: http://www.billauer.co.il
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
try it with DHCP instead
https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/
On Sat, Sep 27, 2014 at 11:36 AM, boazg boaz.ge...@gmail.com wrote:
you need to find a vulnerable site. CGI doesn't have to pass through bash.
you need a site that opens a subshell for something. they aren't uncommon,
but it's not every linux-CGI site.
On Fri, Sep 26, 2014 at 2:33 PM, Eli Billauer e...@billauer.co.il wrote:
Hi,
I did
# yum upgrade bash
on Haifux' server, and it's off the hook. But I was also surprised that
it the attack failed even before that.
Eli
On 26/09/14 12:39, guy keren wrote:
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
--guy
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
--
Web: http://www.billauer.co.il
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
Hey Eli.
http://www.tripwire.com/state-of-security/off-topic/shell-shocked-bash-bug-detection-tools-cve-2014-6271/
http://shellshocktest.com/
https://github.com/mubix/shellshocker-pocs
enjoy your PT with all those tools.
On Sat, Sep 27, 2014 at 11:37 AM, boazg boaz.ge...@gmail.com wrote:
try it with DHCP instead
https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/
On Sat, Sep 27, 2014 at 11:36 AM, boazg boaz.ge...@gmail.com wrote:
you need to find a vulnerable site. CGI doesn't have to pass through
bash. you need a site that opens a subshell for something. they aren't
uncommon, but it's not every linux-CGI site.
On Fri, Sep 26, 2014 at 2:33 PM, Eli Billauer e...@billauer.co.il wrote:
Hi,
I did
# yum upgrade bash
on Haifux' server, and it's off the hook. But I was also surprised that
it the attack failed even before that.
Eli
On 26/09/14 12:39, guy keren wrote:
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
--guy
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
--
Web: http://www.billauer.co.il
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
--
בברכה
גיא אדרי
משרד : 227799 - 048
נייד: 2121313 - 054
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
--guy
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
On Sep 26, 2014 12:49 PM, guy keren guy.choo.ke...@gmail.com wrote:
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
For your moment of optimism:
http://istheinternetonfire.com
We haven't had this much fun since the sendmail days...
--Shachar
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
Re: [Haifux] The Bash vulnerability (shellshock)
Hi,
I did
# yum upgrade bash
on Haifux' server, and it's off the hook. But I was also surprised that
it the attack failed even before that.
Eli
On 26/09/14 12:39, guy keren wrote:
On 09/26/2014 12:30 PM, Eli Billauer wrote:
env x='() { :;}; echo vulnerable' bash -c 'echo This is a test'
you're too late - there's a (partial?) fix being distributed around...
--guy
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
--
Web: http://www.billauer.co.il
___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux
