module
Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
Disclosed | Created |
---|---|
09/24/2014 | 05/30/2018 |
Disclosed
09/24/2014
Created
05/30/2018
Description
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
handles external environment variables. This module targets CGI scripts in the
Apache web server by setting the HTTP_USER_AGENT environment variable to a
malicious function definition.
handles external environment variables. This module targets CGI scripts in the
Apache web server by setting the HTTP_USER_AGENT environment variable to a
malicious function definition.
Authors
Stephane Chazelaswvu juan vazquez lcamtuf
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/multi/http/apache_mod_cgi_bash_env_exec msf /(c) > show actions ...actions... msf /(c) > set ACTION < action-name > msf /(c) > show options ...show and set options... msf /(c) > run

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.