Merge pull request #10 from slashbinslashcat/bashcve/bashcve

sunglasses

Author: zardus

what-is-a-bug/bash-cve-2014-7186/challenge/.dockerignore

@@ -0,0 +1 @@
+Dockerfile

what-is-a-bug/bash-cve-2014-7186/challenge/DESCRIPTION.md

@@ -0,0 +1,3 @@
+What truly is a bug? Is it just an unintended side effect of badly written code, or is it a deeper metaphor, highlighting that no matter how hard we try we can never achieve perfection?
+
+I don't know but here is a bash CVE challenge, go crash it.

what-is-a-bug/bash-cve-2014-7186/challenge/Dockerfile

@@ -0,0 +1,31 @@
+# Dockerfile: build unpatched bash-4.3 in a historically-compatible environment
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN mkdir -p /challenge/bin
+COPY run_bashfile.c crash_to_flag.c /challenge/
+
+WORKDIR /opt
+
+# Install build deps (including bison so parse.y is generated)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    cmake python3-pwntools git build-essential wget bison flex gettext gawk perl file ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+# Fetch bash 4.3 source
+RUN wget -q https://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz && \
+    tar -xzf /opt/bash-4.3.tar.gz -C /opt && rm /opt/bash-4.3.tar.gz
+RUN wget https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 -O /challenge/patch.diff
+ADD --chown=0:0 --chmod=6755 http://github.com/pwncollege/exec-suid/releases/latest/download/exec-suid /usr/bin/exec-suid
+WORKDIR /opt/bash-4.3
+
+# Configure and build (debug symbols, no optimization), install to /opt/bash43
+RUN CFLAGS="-g -O0 -D_GNU_SOURCE" ./configure --prefix=/opt/bash43 && \
+    make -j"$(nproc)" && \
+    make install
+
+# Build helper binary
+RUN gcc -fPIC -shared -o /challenge/crash_to_flag.so /challenge/crash_to_flag.c
+RUN gcc -I/challenge/include -o /challenge/bin/run_bashfile /challenge/*.c -L/challenge/lib
+RUN chmod 0755 /challenge/bin/run_bashfile
+RUN chmod 755 /opt/bash43/bin/bash

what-is-a-bug/bash-cve-2014-7186/challenge/crash_to_flag.c.j2

@@ -0,0 +1 @@
+{% extends "base_templates/crash_to_flag.c" %}

what-is-a-bug/bash-cve-2014-7186/challenge/run_bashfile.c

@@ -0,0 +1,35 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+    if (argc != 2) {
+        fprintf(stderr, "Usage: %s <shell_script.sh>\n", argv[0]);
+        return 1;
+    }
+
+    const char *filename = argv[1];
+    size_t len = strlen(filename);
+    
+    if (len > 3 && strcmp(filename + len - 3, ".sh") != 0) {
+        printf("The file '%s' is NOT a .sh file.\n", filename);
+        return 1;
+    }
+
+    printf("Running your script: %s\n", filename);
+    printf("=====================================\n\n");
+
+    const char *custom_bash = "/opt/bash43/bin/bash";
+    setenv("LD_PRELOAD", "/challenge/crash_to_flag.so", 1);
+    char *newargv[] = { (char *)custom_bash, (char *)filename, NULL };
+    int ret = execv(custom_bash, newargv);
+    if (ret == -1) {
+        perror("execl failed");
+        return 1;
+    }
+
+    printf("=====================================\n\n");
+    printf("Script ran sucessfully\n");
+    return 0;
+}

what-is-a-bug/bash-cve-2014-7186/tests_private/test_testcases.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+echo "/opt/bash43/bin/bash --version | grep -m 1 'version'" > /tmp/get_version.sh
+chmod +x /tmp/get_version.sh
+/challenge/bin/run_bashfile /tmp/get_version.sh