I am curious to know if the following command could be executed on a system/server with the Shellshock bug: curl -H User-Agent: () { :; }; sudo /bin/eject http://example.com/(This code is an elaborated version of an example here: http://blog.cloudflare.com/inside-shellshock/)From what I understand the bug would allow one to inject code into the system but not necessarily execute code with elevated privileges. If this is not possible is there another way that code could be injected to give a hacker root privileges? No examples necessary, I am simply curious as to the extent of damage this bug could potentially cause. **I have no malicious intent, I ask out of curiosity.
Can the shellshock bug be expoloited to run a command as a privileged user?
bash;shellshock
 curl -H User-Agent: () { :; }; sudo /bin/eject http://example.com/Wouldn't work because it couldn't find sudo. curl -H User-Agent: () { :; }; /usr/bin/sudo /bin/eject http://example.com/would manage to invoke sudo, but unless the administrator has configured sudo to allow the user running the web server to run any command as root (which would be the most unwise thing to do), that can't do much.Even if the remote server allowed the web server user to run a particular command as root, first, you'd need to guess which it is, and then even if it were a bash script, the HTTP_USER_AGENT environment variable would not be passed to it even if sudo were configured with env_reset disabled because sudo always blacklists the variables whose content starts with ().Though some scenarii can be imagined, there is no common way for shellshock to be used for local privilege escalation. See this answer on security.stackexchange for more details.