问题
I read in the news that Shellshock is another bigger vulnerability after Heartbleed. The code to test if our Bash shell is vulnerable or not is:
env X="() { :;} ; echo shellshock" /bin/sh -c "echo completed"
In detail, how does this code exactly work? What does the code env X="() { :;} ;
do?
How is it vulnerable and can it be exploited if I am hosting a website in a Linux environment where the shell is vulnerable?
回答1:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
What does env
do?
From the documentation, env
runs programs in a modified environment.
env [OPTION]... [-] [NAME=VALUE]... [COMMAND [ARG]...]
It is clear that x
is a name/variable and () { :;}; echo vulnerable'
is the value for the variable.
Now, what is () { :;};
?
When a function is exported, Bash stores its defenition as a value in the environment variable:
$ x() {echo hello world;}
$ export x
$ env | grep x
x=() {echo hello world};
Now, when x='() {:;}'
means similar as writing
$ x() {:;}
$ export x
$ env | grep x
That is, we indirectly made export x
onto the new environmnet created by the env
. Here :
is a null statement in Bash.
来源:https://stackoverflow.com/questions/26052189/can-someone-explain-how-this-shellshock-code-works-in-shell