exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Apache Mod_cgi Bash Environment Variable Injection (Shellshock) Scanner

Posted Sep 1, 2024

Authored by Michal Zalewski, wvu, Stephane Chazelas | Site metasploit.com

This Metasploit module scans for the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This Metasploit module targets CGI scripts in the Apache web server by setting the HTTP_USER_AGENT environment variable to a malicious function definition. PROTIP: Use exploit/multi/handler with a PAYLOAD appropriate to your CMD, set ExitOnSession false, run -j, and then run this module to create sessions on vulnerable hosts. Note that this is not the recommended method for obtaining shells. If you require sessions, please use the apache_mod_cgi_bash_env_exec exploit module instead.

tags | exploit, web, shell, cgi, bash

advisories | CVE-2014-6271, CVE-2014-6278

SHA-256 | 87c833264ee49ea156b8462740c64928a943a3c37c5f3d9c388659dfaa1d03a0

Download | Favorite | View

Related Files

No related files