{"uuid": "cdd68439-061d-4a07-8d8f-44ddf9467239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6271", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/dhcp/bash_environment.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Stephane Chazelas\", \"egypt \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits the Shellshock vulnerability, a flaw in how the Bash shell\\n          handles external environment variables. This module targets dhclient by responding\\n          to DHCP requests with a malicious hostname, domainname, and URL which are then\\n          passed to the configuration scripts as environment variables, resulting in code\\n          execution. Due to length restrictions and the unusual networking scenario at the\\n          time of exploitation, this module achieves code execution by writing the payload\\n          into /etc/crontab and then cleaning it up after a session is created.\", \"disclosure_date\": \"2014-09-24\", \"fullname\": \"exploit/unix/dhcp/bash_environment\", \"is_install_path\": true, \"mod_time\": \"2025-05-07 00:22:34 +0000\", \"name\": \"Dhclient Bash Environment Variable Injection (Shellshock)\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"Shellshock\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/unix/dhcp/bash_environment.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/dhcp/bash_environment\", \"references\": [\"CVE-2014-6271\", \"CWE-94\", \"OSVDB-112004\", \"EDB-34765\", \"URL-https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/\", \"URL-https://seclists.org/oss-sec/2014/q3/649\", \"URL-https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:34.260106Z"}