Can someone explain how this “Shellshock” code works in shell [duplicate]

梦想与她 提交于 2019-12-02 10:38:17

问题


I read in the news that Shellshock is another bigger vulnerability after Heartbleed. The code to test if our Bash shell is vulnerable or not is:

env X="() { :;} ; echo shellshock" /bin/sh -c "echo completed"

In detail, how does this code exactly work? What does the code env X="() { :;} ; do?

How is it vulnerable and can it be exploited if I am hosting a website in a Linux environment where the shell is vulnerable?


回答1:


env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

What does env do?

From the documentation, env runs programs in a modified environment.

env [OPTION]... [-] [NAME=VALUE]... [COMMAND [ARG]...]

It is clear that x is a name/variable and () { :;}; echo vulnerable' is the value for the variable.

Now, what is () { :;};?

When a function is exported, Bash stores its defenition as a value in the environment variable:

$ x() {echo hello world;}
$ export x
$ env | grep x
x=() {echo hello world};

Now, when x='() {:;}' means similar as writing

$ x() {:;}
$ export x
$ env | grep x

That is, we indirectly made export x onto the new environmnet created by the env. Here : is a null statement in Bash.



来源:https://stackoverflow.com/questions/26052189/can-someone-explain-how-this-shellshock-code-works-in-shell

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!