Knowledge Is Everything

Shellshock, also known as Bashdoor, is a security bug in the widely used Unix Bash shell which was disclosed on 24 September 2014.Many Internet daemons, such as web servers, use Bash to process certain commands, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system.
The below python code allows us to test a remote machine for shellshock vulnerability if we have the ip, username and password of the remote machine.For testing this code we need to install a simple utility in ubuntu called sshpass.sshpass is a utility designed for running ssh using the mode referred to as “keyboard-interactive” password authentication, but in non-interactive mode.Just type,

 import sys  
 from subprocess import Popen,PIPE  
 ip = raw_input("Enter SSH IP or Domain \n")  
 username = raw_input("Enter SSH Username \n")  
 password = raw_input("Enter SSH Password \n")  
 p = Popen(["sshpass", "-p", password+'\r', "ssh", "-o UserKnownHostsFile=/dev/null", "-o StrictHostKeyChecking=no", username+'@'+ip, "env x='() { :;};echo -n vulnerable' bash -c echo -n ''"], stdin=PIPE, stdout=PIPE, stderr=PIPE).communicate()  
 status = p[0].strip()  
 if status.find("vulnerable") == -1:  
     print ip + " is not vulnerable"  
 else:  
     print ip + " is vulnerable"