Anatomy of the Shellshock vulnerability

If you thought, remotely seizing a machine and making it obey your orders was what sci-fi movies were made of, think again! The Shellshock vulnerability or the Bash bug vulnerability discovered in September of 2014 by Stephane Chazelas, a security researcher at Akamai firm allowed hackers to do exactly that in reality!
 It was different from other vulnerabilities because it attacked Unix, Linux and Mac OS machines instead of the traditional Windows systems. NIST (National Institute of standards and technology) named the vulnerability as, CVE-2014-7169.  It is to be noted that the terms Shellshock and Bash bug will be used interchangeably in this article.
 Why is it so named?
It was so named because it exploited a vulnerability in the shell of the Unix, Mac OS and Linux operating systems. The Shell of the Unix and Linux environment is known as GNU ‘Bourne again shell’ which gives the vulnerability its name ‘BASH’. The vulnerability affected all versions of Bash from 1.14 to 4.3.
This shell is the command line interpreter (that which is used to run commands) which is the crucial component in the vulnerability. The critical point about the Bash bug or the Shell shock vulnerability is that the machine can be exploited remotely and can be brought completely under the control of the attacker.

Hungry? Order from Swiggy!! 🙂 

In a nutshell, how does it work?
The flawed design of Linux/Unix/Mac OS Bash shell executes code after definition of the environment variable, first. Web applications are particularly susceptible since they take user input and execute accordingly. For example, when setting environment variables
env e=’() { :;}; echo new command’
The interpreter executes the malicious code ‘echo new command’ first, specified after the environment variable and then executes the environment variable.  
What happens if the vulnerability has been exploited on your machine?
If your machine has been compromised and the vulnerability has been exploited these are some of the things that the hacker can do:

1. take complete control of the OS
2. install backdoors
3. view/change database usernames and passwords
4. ruin the web server by modifying its contents
5. deface websites(TrendLabs Security Intelligence blog, 2014)

Now let’s move onto the move onto the most important point of the article, the anatomy of the attack.
 
Anatomy of the Shellshock attack:
The shellshock or the Bash bug vulnerability can be exploited under three circumstances:

1. Machines running HTTP server using CGI scripts(which require no authentication)
2. Machines running SSH(which require authentication)
3. Machines running DHCP server

 

 
     We will discuss the anatomy of the Shellshock attack on the HTTP server running CGI scripts.
As an example, let us consider two machines one running Kali Linux (which is the victim machine) and one running Ubuntu OS (which is the attacker machine) Our Kali Linux system will be using the Apache web server which will be victim server.

1. Create a CGI script and save it with .cgi extension on the victim machine. For simplicity, place it in the root folder of the Apache web server.
2. Make sure the CGI script is executable and Apache web server executes it.
3. Start the web server and execute the CGI script to make sure that it works accordingly
4. Go to the attacker machine and create a ‘reverse TCP payload’ by means of Metasploit. Metasploit being a bundle of payloads and exploits – it is wise to use the popular ‘msfpayload’ for this. Note: The “reverse shell” is used by the attacker to create a listener on his machine and the victim machine connects to it. The attacker then gets the shell code.
5. Once the “payload” has been created, make sure to see that it is indeed there.
6. The ‘curl’ command is then used to send the payload to the victim machine by making use of ‘Bash’ vulnerability. The ‘curl’ command is the command to send data to/from a server. This can be monitored by the listener on the attacker machine. By now, the victim machine is completely under the control of the attacker. (EXPLAINED: What is SHELL SHOCK or BASH BUG and How to EXPLOIT!)

This is the successful anatomy of the Shellshock attack. To protect oneself from the Shellshock vulnerability, it is necessary to apply regular updates as and when they are released.

Bibliography

EXPLAINED: What is SHELL SHOCK or BASH BUG and How to EXPLOIT! (n.d.). Retrieved from Youtube.com: https://www.youtube.com/watch?v=u1H12rMdLTg
TrendLabs Security Intelligence blog. (2014, September 25). Retrieved from TrendMicro: https://blog.trendmicro.com/trendlabs-security-intelligence/shell-attack-on-your-server-bash-bug-cve-2014-7169-and-cve-2014-6271/