+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Got A Shell, Apparently Vuln To Shellshock but can't exploit (/showthread.php?tid=4566834)
Got A Shell, Apparently Vuln To Shellshock but can't exploit - Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ - Dec 2, 2014
So I've got my shell on a site and I've done this command
bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable
And it prints out vulnerable
But when I go
bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || id
I still get
uid=1514(vin47827) gid=1509(vin47827) groups=1509(vin47827)
So is it even vuln or what?
* - How bout using your brain - Dec 3, 2014
well you got command execution, what else do you want?
* - Kusanagi - Dec 24, 2014
What are you trying to do? You tested the env var, and it says vulnerable, all you're doing in the second one is printing the group/usr you're running as, which makes it seem like that's what you intended to do.
* - Ichi - Dec 24, 2014
Shellshock doesnt give you root..it's RCE. I dont think you understand what Shellshock is. What else do you want, its working properly?
* - Im gone brah - Dec 24, 2014
LOL, you actually thought it would give you UID 0 priviligies or what? You just tested it to see if it actually was vulnerable.