16.3 Exploiting Vulnerabilities Flashcards
Shellshock is a _________ vulnerability that allows attackers to execute arbitrary Bash code on vulnerable targets.
Shellshock is a **remote code execution (RCE)** vulnerability that allows attackers to execute arbitrary Bash code on vulnerable targets.
With Shellshock, attackers can perform almost any Bash command, including: (3)
- Download sensitive data.
- Send and receive shells to and from the target.
- Backdoor the victim.
Shellshock is made possible by a vulnerability in how servers parse _______.
If a client requests a script, such as /cgi-bin/status.sh, the server will run the script _______ . Then it will send the output back in an HTTP response.
Sometimes, the server needs to use HTTP headers to run ______.
Servers will load HTTP request headers as ______ and run the CGI scripts. The scripts can then access the HTTP headers by reading the _______.
Shellshock is made possible by a vulnerability in how servers parse HTTP requests
If a client requests a script, such as /cgi-bin/status.sh, the server will run the script status.sh. Then it will send the output back in an HTTP response.
Sometimes, the server needs to use HTTP headers to run CGI scripts.
Servers will load HTTP request headers as Bash environment variables and run the CGI scripts. The scripts can then access the HTTP headers by reading the variables.
True or False:
Bash sanitizes headers before loading them as environment variables. This means it loads whatever value is sent in the header.
False
Bash does not sanitize headers before loading them as environment variables. This means it loads whatever value is sent in the header.
The request below results in _______ being set to _______. This is cryptic, but in vulnerable versions of Bash, this creates a code function that does _______.
bash
GET /index.html HTTP/1.1
Host: example.com
User-Agent: () { :;};
Connection: keep-alive
Bash interprets the value of this header as ______. This allows us to execute ______ on the target.
The request below results in HTTP_USER_AGENT being set to **() { :;};**. This is cryptic, but in vulnerable versions of Bash, this creates a code function that does nothing.
Bash interprets the value of this header as code. This allows us to execute arbitrary code on the target.
Shellshock can be exploited when we include malicious code after the seemingly useless _____ string.
() { :;};
Shellshock payloads are often executed with the following template:
________ runs the string ________ as a Bash command. This is different from passing a command directly because of how Bash handles the output.
- Using _______ helps preserve ______ more consistently.
**/bin/bash -c '**command' runs the string **'command'** as a Bash command. This is different from passing a command directly because of how Bash handles the output.
Using /bin/bash -c helps preserve stdout more consistently.
What is Searchsploit?
“Searchsploit” is a command-line search tool for Exploit-DB, which also allows you to bring a copy of Exploit-DB with you. SearchSploit provides you with the ability to perform detailed offline searches in locally saved repositories.
Think about it as an offline copy mode so you don’t need an internet connection to work with the data.
_________ is a popular online database that contains publicly disclosed exploits, cataloged according to their Common Vulnerability and Exposure (CVEs) identifier.
**Exploit Database (Exploit-DB)** is a popular online database that contains publicly disclosed exploits, cataloged according to their Common Vulnerability and Exposure (CVEs) identifier.
CVE numbers typically start with ___________.
CVE numbers typically start with the year in which the vulnerability was discovered.
What does SearchSploit allow security professionals to do?
SearchSploit allows security professionals to perform detailed offline searches of hundreds of exploit scripts through their local copy of the repository.
This capability is useful if you are working on a security assessment with an air-gapped, segregated network that lacks internet connectivity.
SearchSploit, as indicated by its name, will search for all ______ and ______contained within the Exploit-DB repository.
SearchSploit, as indicated by its name, will search for all exploits and shellcode contained within the Exploit-DB repository.
What do these commands do?
- searchsploit -u
- searchsploit -h
- searchsploit ftp remote file
- searchsploit -t oracle windows
- searchsploit -t oracle windows | wc -l
- searchsploit linux kernel 4.4 –exclude=”(PoC)|/DCCP/”
- searchsploit mysql 6.0 -w
- This will ensure that you have the latest updates
- Built-in help option
- This command will search the exploit database for the three terms:
ftp,remote, andfile. - Searches can be restricted to specific titles with the
-toption. - The
wc -loption will return the number of exploits in the search - –exclude=”(PoC)|/DCCP/”
: Leaves out all lines that contain bothPoCandDCCP`. - The search query returns URLs of the webpage of the associated exploit.
Breakdown this SearchSploit command:
If we wanted to run the following exploit script exploits/windows/remote/43993.py, we would need to use the Python command as follows:
python exploits/windows/remote/43993.py payload=bind rhost=172.168.0.10 rport=1234
- python: Command required to run Python scripts.
- exploits/windows/remote/43993.py: Name of the Python exploit script.
- payload=bind: The payload setting. In our example, our payload is a **bind** payload.
- We use a bind payload when we know the IP address of the target. We’ll discuss the specifics of bind shells and payloads in the next unit.
- rhost=172.168.0.10: IP address of the remote host.
- rport=1234: Port number of the remote host.
SearchSploit is a _________ for _______ that allows you to _______________________.
Security professionals can perform _______________ using ___________________.
SearchSploit comes preinstalled on ________ and should be ___________.
SearchSploit is a command-line utility for Exploit-DB that allows you to take an offline copy of the entire Exploit Database with you wherever you go.
Security professionals can perform detailed offline searches of hundreds of exploit scripts from Exploit-DB using the locally checked-out copy of the online repository.
SearchSploit comes preinstalled on Kali Linux and should be updated regularly.
