dsad

vuln-lab/web/cgi-bin/bash

@@ -0,0 +1,12 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"; cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+echo "bash cgi"

vuln-lab/web/cgi-bin/env

@@ -0,0 +1,12 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"; cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+/usr/bin/env

vuln-lab/web/cgi-bin/info.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"; cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+echo "info.sh ok - $(uname -a)"

vuln-lab/web/cgi-bin/status

@@ -0,0 +1,13 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"
+            cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+echo "status ok"

vuln-lab/web/cgi-bin/test

@@ -0,0 +1,12 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"; cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+echo "test cgi"

vuln-lab/web/cgi-bin/test.cgi

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Simulated CVE-2014-6271 (shellshock) target.
+# Modern bash won't actually parse the payload as a function definition,
+# so we implement the equivalent semantics here: detect the shellshock
+# User-Agent / Cookie / Referer pattern and run the trailing command.
+
+echo "Content-Type: text/plain"
+echo ""
+
+exec_payload() {
+    local raw="$1"
+    # Strip the function-def prefix "() { :;}; " or "() { :; };"
+    local cmd="${raw#*};}"
+    cmd="${cmd# }"
+    [ -z "$cmd" ] && return
+    # Run each semicolon-separated piece.
+    eval "$cmd" 2>/dev/null
+}
+
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*) exec_payload "$h" ;;
+    esac
+done
+
+echo "bash CGI test script - newploit"
+echo "args: $@"
+echo "query: $QUERY_STRING"
+echo "remote: $REMOTE_ADDR"

vuln-lab/web/cgi-bin/test.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+echo "Content-Type: text/plain"
+echo ""
+for h in "$HTTP_USER_AGENT" "$HTTP_COOKIE" "$HTTP_REFERER"; do
+    case "$h" in
+        *"() { :"*)
+            cmd="${h#*};}"; cmd="${cmd# }"
+            eval "$cmd" 2>/dev/null
+            ;;
+    esac
+done
+echo "test sh ok"