[B! bash] rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rryu id:rryu

bashã«é–¢ã™ã‚‹rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

bashã®çµ„è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰è‡ªä½œã«ã‚ˆã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®é«˜é€ŸåŒ– - Qiita
ã¯ã˜ã‚ã« bashã«ã¯æ¬¡ã®2ã¤ã®ç†ç”±ã«ã‚ˆã£ã¦ã€çµ„ã¿è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰(builtin command)ã¨ã„ã†ã‚‚ã®ãŒå˜åœ¨ã—ã¾ã™ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®é«˜é€ŸåŒ–ã®ãŸã‚ã€‚çµ„ã¿è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰ã§ã‚ã‚Œã°é€šå¸¸ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹å ´åˆã«æ¯”ã¹ã¦ãƒ—ãƒã‚»ã‚¹ã®ç”Ÿæˆã‚³ã‚¹ãƒˆ(fork()/exec())ãŒå‰Šæ¸›ã§ãã‚‹ bashè‡ªèº«ã®çŠ¶æ…‹ã‚’å¤‰æ›´ã•ã›ã‚‹ãŸã‚ã€‚ä¾‹ãˆã°cdã‚³ãƒžãƒ³ãƒ‰ã‚’/bin/cdã¨ã—ã¦ç”¨æ„ã—ã¦bashã‹ã‚‰å½“è©²ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã‚‚ã€å½“è©²ã‚³ãƒžãƒ³ãƒ‰ã®pwdãŒå¤‰æ›´ã•ã‚Œã‚‹ã ã‘ã§ã€bashã®ãã‚Œã¯å¤‰æ›´ã•ã‚Œãªã„ãŸã‚ã€æ„å‘³ãŒãªã„ ä»Šå›žã¯å‰è€…ã«ç„¦ç‚¹ã‚’åˆã‚ã›ã¦ã€ãã®åŠ¹æžœã¨ã€çµ„ã¿è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰ã®è‡ªä½œæ–¹æ³•ã«ã¤ã„ã¦è¿°ã¹ã¾ã™ã€‚ äºˆå‚™çŸ¥è˜: çµ„è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰ã«ã‚ˆã‚‹ã‚¹ã‚¯ãƒªãƒ—ãƒˆé«˜é€ŸåŒ–ã®åŠ¹æžœ çµ„è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰ãã®ã‚‚ã®ã®å˜åœ¨ã€åŠã³ãã®å˜åœ¨æ„ç¾©ã«ã¤ã„ã¦æ—¢ã«ã”å˜çŸ¥ã®ã‹ãŸã¯ã€ã“ã®ç¯€ã‚’é£›ã°ã—ã¦ã‚‚ã‚‰ã£ã¦æ§‹ã„ã¾ã›ã‚“ã€‚ ä¾‹ãˆã°çš†ã•ã‚“ãŒbashã‚¹ã‚¯ãƒªãƒ—ãƒˆã‹ã‚‰echoã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã—ãŸå ´åˆ
rryu 2017/01/18
bashã®ãƒ“ãƒ«ãƒ‰ã‚’ã™ã‚‹ã®ã‹ã¨æ€ã£ãŸã‚‰çµ„ã¿è¾¼ã¿ã‚³ãƒžãƒ³ãƒ‰ã‚’è¿½åŠ ã§ãã‚‹æ©Ÿèƒ½ãŒã‚ã‚‹ã®ã‹ã€‚

bash
ãƒªãƒ³ã‚¯
bash ã®è„†å¼±æ€§ "Shell Shock" ã®ã‚ã£ã¡ã‚ƒç´°ã‹ã„è©± (CVE-2014-6271) - ã‚‚ã‚ãš blog
â€»(2014/10/1 è¿½è¨˜) è„†å¼±æ€§ã®ç•ªå·ã‚’èª¤ã£ã¦ CVE-2014-6721 ã¨è¡¨è¨˜ã—ã¦ã—ã¾ã£ã¦ã„ã¾ã—ãŸ æ£ã—ãã¯ "CVE-2014-6271" ã§ã™ å¤±ç¤¼è‡´ã—ã¾ã—ãŸ â€»(2014/10/7 è¿½è¨˜) 2014/10/7 14:00æ™‚ç‚¹ã§ Shell Shock ã¸ã®ä¿®æ£ãƒ‘ãƒƒãƒã¯6å€‹ å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ æ—¢ã«å¯¾å¿œæ¸ˆã¿ã®ã‚·ã‚¹ãƒ†ãƒ ã§ã‚‚ãƒ‘ãƒƒãƒã®æ¼ã‚ŒãŒãªã„ã‹æ³¨æ„ã—ã¦ãã ã•ã„ ã‚·ã‚§ãƒ«ã«è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã‚‰ã—ã„ã§ã™ ã“ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã¨è„†å¼±æ€§ãŒã‚ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã®ãƒã‚§ãƒƒã‚¯ãŒã§ãã‚‹ã‚ˆã†ã§ã™ $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ä»¥ä¸‹ã®ã‚ˆã†ã«è¡¨ç¤ºã•ã‚ŒãŸã‚‰ã‚¢ã‚¦ãƒˆã§ã™ vulnerable this is a test ã©ã†ã‚„ã‚‰ã€ã“ã®ã‚³ãƒžãƒ³ãƒ‰ãŒæ£å¸¸ã«å®Ÿè¡Œã§ãã‚‹ã¨ã„ã†ã®ãŒã“ã®è„†å¼±æ€§ã®æ£ä½“ã‚‰ã—ãã€ echo vuln
rryu 2014/09/29
é–¢æ•°å®šç¾©æ–‡ã‚’æ™®é€šã«å®Ÿè¡Œã—ã¦é–¢æ•°ã‚’å®šç¾©ã—ã¦ã„ãŸã‚‰ã€é–¢æ•°å®šç¾©ä»¥å¤–ã®ã‚‚ã®ã‚’æ··ãœã‚‰ã‚Œã‚‹ãƒ‘ã‚¿ãƒ¼ãƒ³ãŒã‚ã£ã¦æ»äº¡ã¨ã¯ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock

bash
ãƒªãƒ³ã‚¯
ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã«ãŠã‘ã‚‹Bashè„†å¼±æ€§ã®å³æ»æ¡ä»¶ #ShellShock - ã‚ã‚‚ãŠãã°
æ¡ä»¶1. /bin/shã®å®Ÿä½“ãŒbashã®ãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ RHEL CentOS Scientific Linux Fedora Amazon Linux openSUSE Arch Linux (è‡ªã‚‰è¨å®šã—ãŸå ´åˆ: Debian, Ubuntu) æ¡ä»¶2. å‹•ä½œç’°å¢ƒ CGI (ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã§ã‚ã‚ŠãŒã¡ãªCGIãƒ¢ãƒ¼ãƒ‰ã®PHPç‰ã‚‚å«ã‚€) Passenger(Ruby) æ¡ä»¶3. ãƒ—ãƒã‚°ãƒ©ãƒ å†…å®¹ Passengerã¯å…¨æ»äº¡ *1 systemã‚„ `command`ã€ '| /usr/lib/sendmail' ãªã©ã§å¤–éƒ¨ã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡Œ *2 PHPã®mailã‚„mb_send_mailã€ãã®ä»–ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ç‰ã‚’ä»‹ã—ãŸãƒ¡ãƒ¼ãƒ«é€ä¿¡ *3 ä»¥ä¸‹ã¯æ¡ä»¶1ãŒä¸è¦ æ˜Žç¤ºçš„ã«bashã‚’å‘¼ã¶ å…ˆé ã§ #!/bin/bash ã‚„ #!/usr/bin/env bash ã—ã¦ã„ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’å®Ÿè¡Œ (rbenv
rryu 2014/09/28
PassengerLoadShellEnvvarsãŒONã ã¨ãƒ¯ãƒ¼ã‚«ãƒ¼ã‚’ã‚·ã‚§ãƒ«çµŒç”±ã§èµ·å‹•ã™ã‚‹ã®ã§å³æ»ã¨ã„ã†ã“ã¨ã‚‰ã—ã„ã€‚ãã—ã¦ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã¯ONâ€¦â€¦

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock

bash

rails
ãƒªãƒ³ã‚¯
bashã®è„†å¼±æ€§(CVE-2014-6271) #ShellShock ã®é–¢é€£ãƒªãƒ³ã‚¯ã‚’ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
bashã«è„†å¼±æ€§ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦é¨’ãŽã«ãªã£ã¦ã„ã¾ã™ã€‚ã“ã“ã§ã¯CVE-2014-6271ã«é–¢ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ #è¨˜è¼‰å†…å®¹ã«ã¤ã„ã¦ã€èª¤ã£ã¦ã„ã‚‹ã€è¿½è¨˜ã—ãŸæ–¹ãŒã„ã„ç‰æƒ…å ±ãŒã”ã–ã„ã¾ã—ãŸã‚‰@piyokangoã¾ã§ã”é€£çµ¡ãŠé¡˜ã„ã—ã¾ã™ã€‚ è„†å¼±æ€§æƒ…å ± è„†å¼±æ€§ã®æ„›ç§° ShellShock Bashbug CVEç•ªå· Bashå‘¨ã‚Šã§ç™ºè¡Œã•ã‚Œã¦ã„ã‚‹CVEã¯6ã¤ã€‚ãã®å†…è©³ç´°ãŒä¸æ˜Žãªã®ãŒ2ã¤ã€‚(CVE-2014-6277,CVE-2014-6278) CVE ç™ºè¦‹è€… æƒ³å®šè„…å¨ ç‰¹è¨˜ CVE-2014-6271 Stephane Chazelasæ° ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œ ShellShockã®ç™ºç«¯ã¨ãªã£ãŸãƒã‚°ã€‚ CVE-2014-7169 Tavis Ormandyæ° ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œ CVE-2014-6271ä¿®æ£æ¼ã‚Œã«ã‚ˆã‚‹è„†å¼±æ€§ CVE-2014-7186 Redhat DoS ãƒ¡ãƒ¢ãƒªç ´å£Š(Out-of-Bo
rryu 2014/09/25
å„ç¨®ãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã®æƒ…å ±ã¸ã®ãƒªãƒ³ã‚¯ãªã©ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

bash
ãƒªãƒ³ã‚¯
Blog: bashã®è„†å¼±æ€§ãŒãƒ¤ãƒã™ãŽã‚‹ä»¶ â€“ x86-64.jp - ãã‚Šã™ç ”
Browse by time: December 2018 (1) December 2016 (1) December 2015 (1) January 2015 (1) September 2014 (2) July 2014 (2) April 2014 (1) February 2014 (1) January 2014 (3) December 2013 (2) September 2013 (3) June 2013 (1) May 2013 (1) April 2013 (1) March 2013 (2) February 2013 (5) ã‚„ã£ã¨æ›´æ–°ã™ã‚‹æ°—ã«ãªã£ãŸã€‚ ã‚‚ãã˜ 0. ç”£æ¥ã§èª¬æ˜Ž 1. ç†è«–ç·¨ 2. æ”»æ’ƒç·¨ 3. ãƒ‘ãƒƒãƒ 4. çµè«– 0. ç”£æ¥ã§èª¬æ˜Ž bashãŒ ã‚¢ãƒ›ã§ åœ°çƒãŒãƒ¤ãƒã‚¤ 1. ç†è«–ç·¨ bashã®é–¢æ•°æ©Ÿèƒ½ã¯ã€ç’°å¢ƒå¤‰æ•°ã®ä¸ã§ã‚‚ä½¿ãˆã‚‹ä»•æ§˜ã«ãªã£ã¦ã„ã¾ã™
rryu 2014/09/25
ç’°å¢ƒå¤‰æ•°åã‚’è˜åˆ¥åã¨ã—ã¦é–¢æ•°ã‚’å®šç¾©ã™ã‚‹ã¨ãã«ç’°å¢ƒå¤‰æ•°å…¨ä½“ã‚’ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã¨ã—ã¦è§£é‡ˆã—ã¦æ»äº¡ã¿ãŸã„ãªæ„Ÿã˜ãªã‚“ã ã‚ã†ã‹ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

bash
ãƒªãƒ³ã‚¯
nanapiå‹‰å¼·ä¼š vol2 ã§ã€ã‚·ã‚§ãƒ«ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã®è©±ã‚’ã—ã¦ããŸ #nanapi_study - å…ƒRX-7ä¹—ã‚Šã®é©å½“ãªæ—¥ã€…
nanapiã®CTOã§ã‚ã‚‹@wadapã•ã‚“ã«å£°ã‚’ã‹ã‘ã¦ã„ãŸã ã„ã¦ã€LTã‚’ã‚„ã£ã¦ãã¾ã—ãŸã€‚ nanapiå‹‰å¼·ä¼š vol2 - Shellã®æ´»ç”¨ã§ã“ã‚Œã ã‘æ¯Žæ—¥ãŒä¾¿åˆ©ã«ãªã‚‹ LTã§ä½¿ã£ãŸè³‡æ–™ã‚’ä»¥ä¸‹ã«å…¬é–‹ã—ã¦ãŠãã¾ã™ã€‚ bash(set)ã‚³ãƒžãƒ³ãƒ‰ã®ã‚ªãƒ—ã‚·ãƒ§ãƒ³3é¸ from Yuuki Namikawa è³‡æ–™ã ã‘ã ã¨ä¼ã‚ã‚Šã¥ã‚‰ã„ã§ã™ãŒã€åƒ•ãŒã“ã®LTã§è©±ã—ãŸã‹ã£ãŸã“ã¨ã§ã™ãŒã€å®Ÿã¯æœ¬ç·¨ã¯ãŠã¾ã‘ã¿ãŸã„ãªã‚‚ã®ã§ã€ç¾åœ°ã§ã—ã‚ƒã¹ã£ãŸã¨ãŠã‚Šã§ã™ãŒã€ã‚¹ãƒ©ã‚¤ãƒ‰3æžšç›®ã€œ5æžšç›®ã®éƒ¨åˆ†ã§ã™ã€‚ å˜ç´”ã«ã€å…ˆæ—¥ç™ºå£²ã«ãªã£ãŸChefå®Ÿè·µå…¥é–€ã®å®£ä¼ï½—ã¨ã€ã‚‚ã†1ã¤ã¯ã‚·ã‚§ãƒ«ã®Historyã§åˆå¯¾é¢ã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨ä»²è‰¯ããªã‚‹æ–¹æ³•ã§ã™ï½— ã‚¹ãƒ©ã‚¤ãƒ‰4æžšç›®ã«æ›¸ã„ã¦ã‚ã‚‹ã¨ãŠã‚Šã§ã™ãŒã€æ™®æ®µè‡ªåˆ†ãŒä½¿ã£ã¦ã„ã‚‹ã‚·ã‚§ãƒ«ã§ä¾‹ãˆã°ä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã§ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã¨ã€Historyã‹ã‚‰ã€ã‚³ãƒžãƒ³ãƒ‰ã®å®Ÿè¡Œå›žæ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ã‚’å‡ºã—ã¦ãã‚Œã¾ã™ã€‚ $ history | a
rryu 2014/05/31
shell

bash
ãƒªãƒ³ã‚¯
1