env X='() { :; }; echo "CVE-2014-6271 vulnerable"' bash -c id
# will create a file named echo in cwd with date in it, if vulnerable
env X='() { (a)=>\' bash -c "echo date"; cat echo
#!/usr/bin/env bash | |
ethernet="enp0s20u3u1u3" | |
wireless_network="wlp3s0-syn-ack-5GHz" | |
monitor_left="DP1" | |
monitor_right="DP2-3" | |
monitor_laptop="eDP1" | |
status() { | |
level=$1 |
#!/usr/bin/env bash | |
# To use this with sed the output string needs to be escaped like so: | |
# ./env2json | sed -e 's/[]\/$*.^|[]/\\&/g' | |
# Here is an example: | |
# sed -e "s/{PLACEHOLDER}/$(./env2json | sed -e 's/[]\/$*.^|[]/\\&/g')/" test.conf | |
# http://www.linuxjournal.com/content/bash-associative-arrays | |
# http://stackoverflow.com/questions/3112687/how-to-iterate-over-associative-array-in-bash | |
# http://stackoverflow.com/questions/9449417/how-do-i-assign-the-output-of-a-command-into-an-array |
# Taken from vulnerability report for CVE-2015-0235 | |
# http://www.openwall.com/lists/oss-security/2015/01/27/9 | |
cat > GHOST.c << EOF | |
#include <netdb.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <errno.h> |
#!/usr/bin/env bash | |
# upgrade bash (from source) to | |
# GNU bash, version 4.3.27(1)-release (x86_64-unknown-linux-gnu) | |
# POC code: https://gist.github.com/sgviking/99f51a73665d8e52f50b | |
mkdir bash-src | |
cd bash-src | |
# download/verify bash source |