Contents
What is Shellshock exploitation?
In layman’s terms, Shellshock is a vulnerability that allows systems containing a vulnerable version of Bash to be exploited to execute commands with higher privileges. This allows attackers to potentially take over that system. Threat actors exploiting the vulnerability can issue commands remotely on the target host.
What is a Shellshock payload?
The payload is a unique ID created by the attacker so they can trace the ping back to the vulnerable web site. Another technique being used to identify vulnerable servers is to make the web server download a web page from an attacker-controlled machine.
How can I exploit a vulnerability in Shellshock?
If a web server is vulnerable to Shellshock you could attack it by adding the magic string () { :; }; to /bin/eject and then sending that string to the target computer over HTTP. Normally, the User-Agent string would identify the type of browser you are using, but, in in the case of the Shellshock vulnerability, it can be set to say anything.
How is Shellshock being used by the attackers?
Shellshock is being used primarily for reconnaissance: to extract private information, and to allow attackers to gain control of servers. Most of the Shellshock commands are being injected using the HTTP User-Agent and Referer headers, but attackers are also using GET and POST arguments and other random HTTP headers.
How is Shellshock bug affecting Cloudflare firewalls?
On Wednesday of last week, details of the Shellshock bash bug emerged. This bug started a scramble to patch computers, servers, routers, firewalls, and other computing appliances using vulnerable versions of bash. CloudFlare immediately rolled out protection for Pro, Business, and Enterprise customers through our Web Application Firewall.
How are Shellshock commands injected into a server?
Most of the Shellshock commands are being injected using the HTTP User-Agent and Referer headers, but attackers are also using GET and POST arguments and other random HTTP headers. To extract private information, attackers are using a couple of techniques.