rapid7/metasploit-framework — pull request #3897 by jvazquez-r7 (2014-09-26 21:02:33+00:00)
Title: Improve check for BASH HTTP modules

@wchen-r7 pointed which when targeting a #!/bin/bash cgi, something like:

```
#!/bin/bash

echo "Content-type: text/html";
echo ""
echo "hello"

```

Even when it should be vulnerable, the check on both modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb and modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb isn't reporting it. It's because the injection trashes the output generated by the CGI which makes Apache to fail and return an 500 error code:

```
[Fri Sep 26 15:54:18 2014] [error] [client 172.16.158.1] malformed header from script. Bad header=xziRzrHuWZFEc1MVfLYQxziRzrHuWZ: first.sh
```

This pull request tries to improve check method. If the original check fails, but the answer is a 500 result, it makes a second legit request, and compares res.code, returning ```Appears``` if the http code is different.

Feedback is welcome. I won't be hurt if the additional complexity to the check method doesn't worth and is discarded. I think is an interesting case, so here it's the proposed code :)

After this pull request, with the example CGI:

```
tmsf auxiliary(apache_mod_cgi_bash_env) > set targeturi /cgi-bin/first.sh
targeturi => /cgi-bin/first.sh
msf auxiliary(apache_mod_cgi_bash_env) > check
[*] 172.16.158.144:80 - The target appears to be vulnerable.
[*] Checked 1 of 1 hosts (100% complete)
msf auxiliary(apache_mod_cgi_bash_env) > exit -y
```