Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery


This site includes paid links. Please support our sponsors.

Community > The Pub
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Jump to first unread post Pages: 1
BASH ShellShock Vulnerability
    #20616346 -

New Vulnerability affecting bash versions from the last 25 years just hit the public airwaves today.

This looks like it could have very damaging consequences if the flaws aren't patched immediately. I've already managed to leverage this exploit on my homesystems for some low level commands, such as pinging, making directories, etc.. However I've seen evidence of it being used for kernel exploitation and other high level attack.

Just thought I'd spread the word :hatsoff:


http://www.pcworld.com/article/2687857/bigger-than-heartbleed-shellshock-flaw-leaves-os-x-linux-more-open-to-attack.html


--------------------

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: deadwk]
    #20616389 -

The thing is that many/most of the vulnerable systems can't/won't be patched.    You can't download a patch for your security camera or dishwasher.

Looks like it is pretty easy to scan for.

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: Alan Rockefeller]
    #20616418 -

Yea that's true, I mean since it dates back so long there's going to be an insane amount of systems that are infected.

Yea it's extremely easy to scan for, takes around 10-30 seconds depending on how fast you can type or copy+paste lol.

The fix was a little harder though, so unless you have some technical know-how, I can imagine people not being able to fix this.

I feel like in the next week this vulnerability will get hit hard. When I get home I'm going to VM some linux servers and see just how hard I can hit them :lol:


--------------------

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: deadwk]
    #20616605 -

Would be fun to write some perl code that sits on a tcp port and pretends to be vulnerable, then when people exploit you it sends you a text message with what they try to do.  Have it send back ridiculous results.

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: Alan Rockefeller]
    #20616622 -

:lolsy:

That would be funny haha, this vulnerability seems super easy to exploit which is quite scary.


--------------------

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: deadwk]
    #20616836 -

Debian implemented some upstream patches, I'm not sure they are complete yet though.  I've heard that Arch had it fixed before they knew about it and it seems to be fixed with Gentoo also.

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: Byrain]
    #20619091 -

That's good to hear that people are on top of this, however I think you need to specifically update the package. As I use Ubuntu and Debian at home, and both required be actually updating Bash. A normal system wide update+upgrade didn't update the bash shell.

I wouldn't be surprised about Arch and Gentoo though having fixed it already.


--------------------

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: deadwk] * 1
    #20620984 -

I'm on sid, I use this for updating almost everyday.

Code:
#!/bin/bash
sudo apt-get update          &&
sudo apt-get check           &&
sudo apt-get upgrade -f      &&
sudo apt-get dist-upgrade -f &&
sudo dpkg --configure -a     &&
sudo apt-get autoclean       &&
sudo apt-get autoremove -f   &&
sudo aptitude purge '~c'

I got another bash update this morning.

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: Byrain]
    #20622486 -

Ah okay, I'll try that out thanks dude :smile:


--------------------

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: deadwk]
    #20622661 -

You probably don't need all that if you're on stable, its great for sid though.

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: Alan Rockefeller]
    #20623029 -

Alan Rockefeller said:
The thing is that many/most of the vulnerable systems can't/won't be patched.    You can't download a patch for your security camera or dishwasher.

Looks like it is pretty easy to scan for.


I didn't know there was a central processing unit, an operating system stored on a storage drive that needs to be mounted and loaded, and a kernel between the two to allow the OS to direct the input and output in a security camera

You'll have to enlighten me on that one, I was under the impression it was just simple output :lol:


--------------------
:kingcrankey: I did not say to edit my signature soulidarity! Now forever I will never remember what I said about understanding the secrets of the universe by paying attention to subtleties!

:facepalm: I'm never giving you the password again. Jerk

Extras: Filter Print Post Top
Re: BASH ShellShock Vulnerability [Re: imachavel]
    #20623134 -

imachavel said:
I didn't know there was a central processing unit, an operating system stored on a storage drive that needs to be mounted and loaded, and a kernel between the two to allow the OS to direct the input and output in a security camera

You'll have to enlighten me on that one, I was under the impression it was just simple output :lol:



That stuff does not need to be there for a security camera, but if you don't have it, you need to do a lot of coding from scratch.    A much cheaper and easier way to design a security camera is to have an embedded linux box which runs apache.  When a web request comes in, it sticks some of the HTTP fields into bash environment variables and calls the appropriate program. 

The owner of the security camera doesn't realize it is calling bash, or that it is running linux at all.  They just know that their camera has an IP address and they need to make a hole in the firewall for port 80 so they can view their camera when they are away from home.

Extras: Filter Print Post Top
Jump to top Pages: 1

Community > The Pub
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* Cop caught on hidden camera [video]
( 1 2 3 all )		 deXtrous 5,121 42 09/10/07 08:41 PM
by TruuBeeezzy
* Blackberry Upgrade! :update:
( 1 2 all )		 CherryBomM 3,094 27 06/26/08 07:56 PM
by badchad
* my new old-school photo camera Bridgeburner 716 9 07/04/08 04:28 PM
by Bridgeburner
* cameras mayfly 581 8 03/07/08 12:59 PM
by coda
* Jamaica kinda sucks how they Exploit Marley so much
( 1 2 3 4 all )		 PsillyNilly 8,561 63 02/17/05 03:38 PM
by PsillyNilly
* Vulnerability
( 1 2 3 all )		 CherryBomM 3,110 54 09/30/07 09:57 PM
by ZippoZ
* Human Upgrades
( 1 2 3 4 all )		 SkorpivoMusterion 8,598 67 11/18/05 06:22 PM
by PhanTomCat
* The Not So Official Myspace Page Bashing Thread!
( 1 2 3 4 all )		 LeftyBurnz 3,170 69 04/10/08 10:28 AM
by TripityDooDaDay

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: Entire Staff
498 topic views. 3 members, 4,387 guests and 205 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.045 seconds spending 0.016 seconds on 16 queries.