ShellShock-CGI-Scan

ShellShock-CGI-Scan 一个用C编写的脚本，用于检查CGI脚本是否容易受到CVE-2014-6271（Bash漏洞）的影响。 选项： -i 本地IP地址 -p 监听端口 -l 站点列表 -t 连接超时 默认：15秒 示例： $ ./Scanner -i 127.0.0.1 -p 31337 -l sites.txt -t 5 在本地主机的31337端口开始监听，扫描文件'sites.txt'中的站点，并将连接超时设置为5秒。 预览： alt tag...

ShellShock-CGI-Scan

ShellShock-CGI-Scan 一个用 C 语言编写的脚本，用于检查 CGI 脚本是否存在 CVE-2014-6271（Bash 漏洞）漏洞。 选项： -i（本地 IP 地址） -p（监听的端口） -l（网站列表） -t（连接超时时间）（默认：15 秒） 示例： $ ./Scanner -i 127.0.0.1 -p 31337 -l sites.txt -t 5 在 localhost 上启动监听，端口为 31337，扫描文件 'sites.txt' 中的网站，并将连接超时时间设置为 5 秒。 预览： alt tag...

Security Bulletin: Vulnerabilities in bash affect SAN Volume Controller and Storwize Family (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Security Bulletin: Vulnerabilities in Bash affect SAN Volume Controller and Storwize Family CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 Vulnerability Details Security Bulletin --- Summary --- Six Bash vulnerabilities were disclosed in September...

Security Bulletin: UPDATE: Vulnerabilities in Bash affect AIX Toolbox for Linux Applications (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187)

Summary Bash vulnerabilities were disclosed in September 2014. These vulnerabilities have been referred to as “Bash Bug” or “Shellshock”. Bash is optionally available via the AIX Toolbox for Linux Applications web download: http://www.ibm.com/systems/power/software/aix/linux/ If you have bash...

Seagate GoFlex Remote Shell

I have been scanning some ranges in my free time and came across a Seagate GoFlex Home Network Storage System which my scanner flagged as being vulnerable to shellshock but getting a remote shell was no easy task "for me anyway". I ended up having to build a payload with msfvenom and doing the...

Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash

Many shell users, and certainly a lot of the people working in computer forensics or other fields of information security, have a habit of running /usr/bin/strings on binary files originating from the Internet. Their understanding is that the tool simply scans the file for runs of printable...

Mac OS X VMWare Fusion Root Privilege Escalation Exploit

This abuses the bug in bash environment variables CVE-2014-6271 to get a suid binary inside of VMWare Fusion to launch our payload as root. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex...

Remotely Exploitable 'Bash Shell' Vulnerability Affects Linux, Unix and Apple Mac OS X

A Critical remotely exploitable vulnerability has been discovered in the widely used Linux and Unix command-line shell, known as Bash, aka the GNU Bourne Again Shell, leaving countless websites, servers, PCs, OS X Macs, various home routers, and many more open to the cyber criminals. Earlier toda...

CVE-2014-1226 s3dvt Root shell (still)

CVE-2014-1226 s3dvt Root shell still About s3dvt: s3dvt is part of the 3d network display server which can be used as 3d desktop environment. Vulnerability: The s3dvt developers forgot to review all the code. There is still a vulnerable function as in the previous CVE-2013-6825. At the date of Ju...

bash_1.x.txt

Rather dangerous bug is present in output processing after "command substitution" in bash 1.xx. It seems to be NOT present in bash 2.0.x, but I haven't found any bugreport on this vulnerability. I looked for: 'command substitution', 'ff', 'subshell' and '$' CHANGES file, no effects... Seems to be...