[Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ]

So I've got my shell on a site and I've done this command

bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable

And it prints out vulnerable

But when I go
bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || id


I still get

uid=1514(vin47827) gid=1509(vin47827) groups=1509(vin47827)

So is it even vuln or what?

[How bout using your brain]

well you got command execution, what else do you want?

[Kusanagi]

What are you trying to do? You tested the env var, and it says vulnerable, all you're doing in the second one is printing the group/usr you're running as, which makes it seem like that's what you intended to do.

[Ichi]

Shellshock doesnt give you root..it's RCE. I dont think you understand what Shellshock is. What else do you want, its working properly?

[Im gone brah]

LOL, you actually thought it would give you UID 0 priviligies or what? You just tested it to see if it actually was vulnerable.