shellshocker-POCs [http dhcp SSH etc..]

admin

Collection of Proof of Concepts and Potential Targets for #ShellShocker

Command Line (*nix Bash and Windows via Cygwin)

env x='() { :;}; echo vulnerable' bash -c 'echo hello'
IBM z/OS - http://mainframed767.tumblr.com/ ... in-bash-on-z-os-and
HTTP

Metasploit Exploit Module Apache MOD_CGI - https://github.com/rapid7/metasp ... gi_bash_env_exec.rb
HTTP Header Polution by @irsdl - http://pastebin.com/QNkf7dYS
HTTP CGI-BIN - http://pastebin.com/166f8Rjx
cPanel - http://blog.sucuri.net/2014/09/b ... -are-high-risk.html
F5 - https://twitter.com/securifybv/status/515035044294172673
https://twitter.com/securifybv/status/515035044294172673/photo/1
https://twitter.com/avalidnerd/status/515056463589675008
https://twitter.com/avalidnerd/status/515056463589675008/photo/1
Invisiblethreat.ca - https://www.invisiblethreat.ca/2014/09/cve-2014-6271/
DHCP

Trusted sec exploitation via Tftpd32 - https://www.trustedsec.com/septe ... -rce-proof-concept/
Metasploit Exploit Module - https://github.com/rapid7/metasp ... bash_environment.rb
Metasploit Auxiliary Module - https://github.com/rapid7/metasp ... iary/server/dhcp.rb
Perl Script - http://pastebin.com/S1WVzTv9
SSH

Stack Overflow - http://unix.stackexchange.com/qu ... -exploited-over-ssh
SSH ForcedCommand - https://twitter.com/JZdziarski/status/515205581226123264
https://twitter.com/JZdziarski/status/515205581226123264/photo/1
OSX

Priv Escalation via VMware Fusion - https://github.com/rapid7/metasp ... sh_function_root.rb
SIP

SIP Proxies: https://github.com/zaf/sipshock
Qmail

Tweet from @ymzkei5 - http://twitter.com/ymzkei5/status/515328039765307392
http://twitpic.com/ec3615
http://twitpic.com/ec361o
TMNT

https://twitter.com/SynAckPwn/status/514961810320293888/photo/1

via https://github.com/mubix/shellshocker-pocs