Skip to content

Commit fc04bf9

Browse files
committed
Update description
This is what I had when @todb-r7 beat me to the punch. >:P
1 parent 2b127ea commit fc04bf9

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

modules/auxiliary/admin/http/bash_env.rb

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,11 @@ def initialize(info = {})
1313
super(update_info(info,
1414
'Name' => 'Bash Specially-Crafted Environment Variables Code Injection Attack',
1515
'Description' => %q{
16-
This module exploits a remote command injection vulnerability in bash,
17-
a popular shell environment, over an HTTP CGI vector. By passing a specially-crafted
18-
string that is set as an environment variable, attckers may execute arbitrary operating
19-
system commands.
16+
This module exploits a code injection in specially crafted environment
17+
variables in Bash, specifically targeting Apache mod_cgi scripts through
18+
the HTTP_USER_AGENT variable.
2019
21-
For this version of the exploit, the target must already have netcat (nc) compiled with the
22-
-e option.
20+
Netcat with the -e (GAPING_SECURITY_HOLE) option is required.
2321
},
2422
'Author' => ['wvu'],
2523
'References' => [

0 commit comments

Comments
 (0)