+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Shellshock Vulnerability (/showthread.php?tid=5791535)
Shellshock Vulnerability - ernestmiller - Jan 28, 2018
I have found the shellshock vulnerability on a server its HTTP using the CGI method
Created a backdoor payload with fatrat as its a .sh file as its a bash vulnerability.
Created a listener as well for it on the corresponding port
Tried to send the backdoor using the curl to the server
First problem is that I do not have permission to browser the sites CGI files so that does not work, they are backend but picked up as vulnerable by Nikto
If i try and browse to them though i get a 404 response.
Secondly i am pretty sure the packet will get dropped anyway i hp3ing 100 packets to the server and only one got through the firewall