[Discuss] Shellshock

[pw]

On 09/25/2014 08:57 PM, Deryk Barker wrote:
> HOWEVER, when I replace the first two double quotes with singlequotes
> and replace /bin/sh with bash, thusly:
>
> env X='() { :;}; echo busted' bash -c "echo stuff"
>
> then out comes "busted" as well.
>

There is no privilege escalation in this test.

env X='() { :;}; echo busted' bash -c "ls /root"

env X='() { :;}; echo busted' bash -c "passwd root"

As your average user does not provide any more access than
the executing user. The lines above give a suitable error if
you are just an average user with no root group.

There was a note of the TERM environment variable being a vector.
Would that be something like:

TERM="`passwd root`"

(?)

Don't these all assume the attacker is logged in?


Peter