Lab: Shellshock Understanding the problem.

The goal of this step is to setup for the lab.

Step 3: The Shell Shock Vulnerability

Run /bin/bash_shellshock
- The default bash is patched so this error will not occur.
Because we will be changing shells frequently, set the prompt in this one so we know when we return.
- ```
PS1="Shellshock : "
         
```
- DO NOT EXPORT this.
bash is a full programming language including functions

We can declare a function foo as follows (assume $ is the prompt)

NOTE: Spaces are important.

$ foo='() { echo "running function foo"; }'
$ export foo

or we could

$ bar(){ echo "Hello from bar"; }
$ export bar

We can then run the program
- ```
$ foo 
```
You can see these definitions by printenv
Start a new shell
- run /bin/bash_shellshock
- Run foo or bar to see that they are present.
- Exit to get back to your original shell.
Try this. You will need to get this right to move on.
As we have seen, a ; is a terminator in bash.
- Try this strange definition
```
$ bug='() { echo "not the bug"; }; echo "The bug"'
$ export bug
         
```
- You can run this if you wish, but it will do nothing.
- Look at it by printenv bug
- However when you start a new shell, you will see the bug.
- ```
$ /bin/bash_shellshock
BUG!
$ 
```
- In this case, when a new shell is started, the shellshock bug is exposed.
What is happening?
- When the new shell starts, it processes the environment variables.
- the bug routine is stored as a function definition along with the extra code.
- So when a new shell is started, it will parse and execute the code
  - Unfortunately the code to parse and execute, will also execute the command following the };
  - You can see this on line 340 - 350 of variables.c in the shellShock directory
By parsing the environment and creating the function, bash inadvertently ran the extra code.
A simple attack.
- In the shellShock directory is a simple setuid program rootCode
- Look at the source code
- Notice this does a system call.
- System calls are executed with /bin/sh, however
  - On most systems, /bin/sh is a link to /bin/bash
  - Or /bin/bash_shellshock in this case
- Run rootCode, does it suffer from the shellshock bug?
- Can you use this to gain root access? (YES)