Mitigating Bash ShellShock

The Vulnerability

 

The Environment

• index.php
• bashcgi.sh

The Index

The Bash Script

$ ./bashcgi.sh "() { :; }; touch my_touched_file"

Remote Execution

Exploit Flow

Impact

Recommendations for Mitigation

• Shellshock type attacks can be avoided by not processing user data directly as variables in web/bash code. An example of this could be to base64 encode user input as it is stored in a variable.
• By sanitizing user input and removing un-needed characters, developers can disrupt an attack before it takes place.
  • bash example:
    • x=$(echo "$1"| tr -d "\(\) { :. }")
    • export x
• Utilize the free CrowdStrike Shellshock Scanner created by our own Robin Kier.
  • http://blog.crowdstrike.com/crowdstrike-shellshock-scanner/
• Monitor logs for evidence of attempted or successful command execution.
  • egrep "\(\) \{ :\; \}" logs.txt
  • See the apache access log/mail alert sample script below:

 
#!/bin/bash
#Shellshock Log Monitor v1.0 for Apache Access Log
#Copyright CrowdStrike 2014

#This script is designed to be executed every minute using your systems crontab
# * * * * * /bin/bash /usr/bin/shockmon.sh 2>> ~/shockmon_err.log

#configurable variables#
#You can modify which log file is monitored as long as log matches the date format in the sample provided below.
#Sample apache access log date format: 06/Oct/2014:17:25:22
log_to_check=/var/log/httpd-access.log
tdir=/tmp/
#tdir can also use /dev/shm/ on appropriate systems
email=your.email@yourdomain.com
########################
#Other Variables
sleep 2
dcheck=$(date)
dategrep="$(echo $dcheck|awk '{print $3}')/$(echo $dcheck | awk '{print $2}')/....:$(echo $dcheck|awk '{print $4}'|cut -d":" -f1):$(($(echo $dcheck|awk '{print $4}'|cut -d":" -f2|cut -d":" -f1)-1))" #Could likely do this all with awk or sed, but it works! 

messagefile=$tdir$RANDOM$RANDOM.shellshockmsg.txt
IFS=$'\n'
########################

egrep $dategrep $log_to_check | egrep "\(\) \{ :\; \}" >> $messagefile
checklog=$( egrep "\(\) \{ :\; \}" $messagefile | wc -l)
if << "$checklog" -gt "0" >>;then
        messagefile2=$messagefile.2
        for i in $(cat $messagefile);do echo "$i 
" >> $messagefile2;done
        #this assumes you have your *nix mail command setup properly
        mail -s "$(echo -e "Shellshock Alert\nFrom: ShellshockAlert <shellshock_do_not_reply@127.0.0.1>\nContent-Type: text/html\n")" $email < $messagefile2
        rm $messagefile2
fi
rm $messagefile

• Monitoring network traffic for the string

   

  “() {“.
  • Many snort and suricata rules already exist for detecting this string in network traffic. CrowdStrike’s Josh Liburdi has released a Bro script to aid in detection of attempted and successful exploitation.

# Monitors traffic for Shellshock exploit attempts
# When exploits are seen containing IP addresses and domain values, monitors traffic for 60 minutes watching for endpoints to connect to IP addresses and domains seen in exploit attempts
# CrowdStrike 2014

@load base/frameworks/notice
@load base/protocols/http
@load base/protocols/dhcp

module CrowdStrike;

export {
  redef enum Notice::Type += {
    Shellshock_DHCP,
    Shellshock_HTTP,
    Shellshock_Successful_Conn
  };
}

const shellshock_pattern = /\x28\x29\x20\x7b\x20/ &redef;

const shellshock_commands = /wget/ | /curl/;

global shellshock_servers: set &create_expire=60min;
global shellshock_hosts: set &create_expire=60min;

# function to locate and extract domains seen in shellshock exploit attempts
function find_domain(ss: string)
{
local parts1 = split_all(ss,/<<:space:>>/);
for ( p in parts1 )
  if ( "http" in parts1
 )
    {
    local parts2 = split_all(parts1
,/\//);
    local output = parts2<5>;
    }

if ( output !in shellshock_hosts )
  add shellshock_hosts;
}

# function to locate and extract IP addresses seen in shellshock exploit attempts
function find_ip(ss: string): bool
{
local b = F;
local remote_servers = find_ip_addresses(ss);

if ( |remote_servers| > 0 )
  {
  b = T;
  for ( rs in remote_servers )
    {
    local s = to_addr(remote_servers);
    if ( s !in shellshock_servers )
      add shellshock_servers;
    }
  }

return b;
}

# event to identify shellshock HTTP exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( ! is_orig ) return;
if ( shellshock_pattern !in value ) return;

# generate a notice of the HTTP exploit attempt
NOTICE(<$note=Shellshock_HTTP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock HTTP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",value),
        $identifier=cat(c$id$orig_h,c$id$resp_h,value)>);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(value) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in value )
  find_domain(value);
}

# event to identify shellshock DHCP exploit attempts
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string)
{
if ( shellshock_pattern !in host_name ) return;

# generate a notice of the DHCP exploit attempt
NOTICE(<$note=Shellshock_DHCP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock DHCP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",host_name),
        $identifier=cat(c$id$orig_h,c$id$resp_h,host_name)>);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(host_name) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in host_name )
  find_domain(host_name);
}

# event to identify endpoints connecting to domains seen in shellshock exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5
{
if ( name != "HOST" ) return;
if ( value in shellshock_hosts )
  # generate a notice of HTTP connection to domain seen in exploit attempts
  NOTICE(<$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to a domain seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("Domain: %s",value),
          $identifier=cat(c$id$orig_h,value)>);
}

# event to identify endpoints connecting to IP addresses seen in shellshock exploit attempts
event connection_state_remove(c: connection)
{
if ( c$id$resp_h in shellshock_servers )
  # generate a notice of connection to IP address seen in exploit attempts
  NOTICE(<$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to an IP address seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("IP address: %s",c$id$resp_h),
          $identifier=cat(c$id$orig_h,c$id$resp_h)>);
}