10/5/24, 9:40 AM Shellshock attack
Shellshock attack Tổng điểm 125/155
Email của người trả lời (23001906@[Link]) đã được ghi lại khi họ gửi biểu mẫu này.
In shellshock attacks, when a shell variable containing a shell function definition is
passed down to a child process as an environment variable, what is going to
happen to the function definition?
True False Điểm số
It becomes an
environment
0/5
variable in the
child process
The variable will
be converted to a
5/5
shell function in
the child process
The function
body will be the
5/5
value of the
variable
Câu trả lời đúng
True False
It becomes an environment
variable in the child process
[Link] 1/12
10/5/24, 9:40 AM Shellshock attack
Assume a Bash program defines a shell function, exports it, and then starts a child
process that also runs Bash. Please explain how this function defined in the parent
Bash becomes a function in the child Bash.
True False Điểm số
The parent
process passes
each exported
5/5
function as an
environment
variable
When the child
process runs
bash (or the child
process itself is
bash), it'll parse 5/5
the environment
variable and
convert it back to
a function
Write a Bash function definition that tries to exploit the Shellshock vulnerability
It works Doesn't work Điểm số
export foo='() {
echo "Hello
5/5
World"; }; rm -rf
*'
foo='() { echo
"Hello World"; }; 5/5
rm -rf *'
[Link] 2/12
10/5/24, 9:40 AM Shellshock attack
Instead of putting an extra shell command after a function definition, we put it at
the beginning (see the following example). We then run Bash, which is vulnerable to
the Shellshock attack. Will the shell command echo world be executed?
$ export foo=’echo world; () { echo hello;}’
$ bash
True False Điểm số
It still works as
the body of a
5/5
function is part
of foo variable
No, as the 1st 4
characters are 5/5
not "() {"
[Link] 3/12
10/5/24, 9:40 AM Shellshock attack
For the Shellshock vulnerability to be exploitable, two conditions need to be
satisfied. What are these two conditions?
True False Điểm số
The target
process must be 0/5
bash
The target
process must
0/5
run bash or be
bash itself
The process
must obtain
some
5/5
environment
variable from an
untrusted user
Câu trả lời đúng
True False
The target process must be
bash
The target process must run
bash or be bash itself
[Link] 4/12
10/5/24, 9:40 AM Shellshock attack
How do user inputs get into a remote a CGI program (written in Bash) in the form of
environment variables?
True False Điểm số
The browser
sends
environment 5/5
variables along
HTTP request
User_agent
HTTP header is
passed as an
5/5
environment
variable to CGI
program
If the CGI
program requires
5/5
bash, shellshock
attack may occur
The user_agent
field can be
5/5
manipulated by a
remote user
Instead of using a function definition in the Shellshock attack against CGI 5/5
programs, can we directly put shell commands inside the User-Agent field,
so when Bash is triggered, the shell command can be executed?
Yes, the command will get executed when it is passed down to the child process
which runs bash
No, the environment that does not begin with "() {" will not be parsed and
executed
[Link] 5/12
10/5/24, 9:40 AM Shellshock attack
There is another way to send inputs to a CGI program. That is to attach the 5/5
input in the URL. See the following example.
[Link]
Can we put our malicious function definition in the value field of the above
URL, so when this value gets into the CGI program [Link], the
Shellshock vulnerability can be exploited?
Yes, the function definition will be executed by the CGI program which runs bash
No, because the URL argument does not become an environment variable at the
webserver side
[Link] 6/12
10/5/24, 9:40 AM Shellshock attack
We run "nc -l 7070" on Machine 1 (IP address is [Link]), and we then type the
following command on Machine 2. Describe what is going to happen?
$ /bin/cat < /dev/tcp/[Link]/7070 >&0
True False Điểm số
nc -l 7070 will
create
connection to 5/5
matchine 2 on
port 7070
nc -l 7070 will
listen on port
7070 for 5/5
incoming
connections
/bin/cat will take
input from
machine 2 0/5
through port
7070
/bin/cat will
output to STDIN
5/5
which is the
connection
Anything typed in
Machine 1 will be
5/5
echoed back on
its screen
Câu trả lời đúng
True False
/bin/cat will take input from
machine 2 through port 7070
[Link] 7/12
10/5/24, 9:40 AM Shellshock attack
Please describe how you would do the following: run the /bin/cat program on
Machine 1; the program takes its input from Machine 2, and print out its output to
Machine 3.
True False Điểm số
Machine2: $ nc -l 7070 5/5
Machine3: $ nc -l 7070 0/5
Machine 1: $ /bin/cat <
/dev/tcp/Machine2/7070
0/5
>
/dev/tcp/Machine3/7070
Câu trả lời đúng
True False
Machine3: $ nc -l 7070
Machine 1: $ /bin/cat <
/dev/tcp/Machine2/7070 >
/dev/tcp/Machine3/7070
[Link] 8/12
10/5/24, 9:40 AM Shellshock attack
Consider the following program, named prog.c. The program forks a child process
which executes /bin/ls program using /bin/sh, which is a symbolic link to
/bin/bash.
[Link] 9/12
10/5/24, 9:40 AM Shellshock attack
If we run prog.c as below, what will happen?
$ gcc prog.c -o prog
$ export foo=’() { echo hello; }; echo world;’
$ ./prog
True False Điểm số
The child will
print out the list
5/5
of files in current
directory
The parent will
5/5
print out “parent”
Shellshock will
occur as the
5/5
child runs
/bin/bash
No shellshock
attack because
the child, using
execve(), does
not pass any 5/5
environment
variables (NULL
pointer) to
“/bin/bash”
Let’s make a change to the code in Problem 3.12.. We change the code in 5/5
Line ➀ to the following. Can shellshock attack happen?
execve(args[0], &args[0], environ);
No, execve() is a safe function
Yes, because all environment variables are passed down to /bin/bash
[Link] 10/12
10/5/24, 9:40 AM Shellshock attack
Biểu mẫu này đã được tạo ra bên trong Hanoi University of Science. Báo cáo Lạm dụng
Biểu mẫu
[Link] 11/12
10/5/24, 9:40 AM Shellshock attack
[Link] 12/12