This document provides a case study on Shellshock and discusses various ways it can be exploited including through CGI scripts, SSH servers, and email servers. It analyzes the vulnerability in different operating systems and recommends patching systems and monitoring networks to prevent attacks.

1. )*5$0/ⶳయფ⫨Ⲣਫ਼
4IFMMTIPDLઅ⓮ᑂΩ
$BTF4UVEZPG4IFMMTIPDL
CZTIBPMJO

2. 2
TIBPMJO ௢Ꮛ
TIBPMJO!EFWDPSF

3. 3
4IFMM4IPDLମ▕֞ᴎ⾓Ք⿏⎛⭉⑸

4. 4
#BTI㙪ᮭ4IFMMTIPDLᦡᡂ㦎֞ᴎۃዾ⎛↫Ўᐎࣞ㏱ۗᙜ

5. HFOEB
4IFMMTIPDLأྤᇓ⯁
ᓪђⲄ፧
዗ኄчᷗ$(*ỉ⎛㔄Ўᐎࣞ
๲⑸ྻ࿞%)$1Ўᐎࣞ࿪ᒜ⿏⎸чᷗ⓱
␟⿧(JU4VCWFSTJPOЎᐎࣞỉTIFMM㏗ؕ
዗ኄ.BJMЎᐎࣞ
ऱၥ΍⿬
ಉ⍓
5

6. 6
أྤᇓ⯁

7. ᶁ਴ⴳዾٛͧ₵ધ఍Ϳ() { :;};
ᛦ㘵CBTIⱜᶁ਴ⴳዾ᫗ጫ᠎ిݥ
क़₵ધ఍Ϳ໏ᆵϪ࿞ᅅϝಁᐆ⬦ৎ⫤
() { :;}; echo vulnerable
7
௠⫀␢
4IFMMTIPDLᔘ๭
༓༶ႝ̴

8. 8
ਦͺⲎ࿬ሯᇜ
๏⬜ӷӜ⊉㡯
㘓ా࿅⽽᠎㦑
ტؐय़ጫ౲֜ᶁ਴ⴳዾ
ტؐय़ጫރܛCBTI

9. 9
ᓪђⲄ፧

10. 10
ᑂΩ⯟኿
ߑα⌍⍮⇜ܮ዗ኄᔜϨ
㘓ాܟϞ༢㣉؍ᷗ

11. 11
ᓪђ͡
዗ኄчᷗ$(*ỉ⎛㔄Ўᐎࣞ

12. 12
Ξᴰ$(*᳚ঋˤͥ፦࠵
ᔜϨ͡㦑ᶁ਴ⴳዾ
)551)FBEFS֝౎ᐆఎ֜ᶁ਴ⴳዾ
ᔜϨΧ㦑ৎ⫤CBTI
ᐊαᆵܔᐥ⻳፽CBTITIFMMTDSJQU႙፽֦ఇ
ℨรᐊރܛؐCBTI

13. 13
-BOHVBHF 7VMOFSBCMF'VODUJPO
1FSM
FYFD EBUFEFWOVMM
PQFO 4)--4)0$,
]EBUFEFWOVMM
TZTUFN EBUFEFWOVMM
QSJOUAEBUFEFWOVMMA
1)1
FYFD EBUF
TZTUFN EBUF
NC@TFOE@NBJM
1ZUIPO
PTTZTUFN EBUF
TVCQSPDFTTDBMM EBUF
TIFMM5SVF
TVCQSPDFTT1PQFO EBUF
TIFMM5SVF
3VCZ
AEBUFA
FYFDEBUF
TZTUFNEBUF

14. 14
DVSM
^FDIPCJODBUFUDQBTTXEIUUQUBSHFU
዗ኄḅ㒘Ⴆॎ

15. 16
㔃கਦͺդᴰ
࡬ね
Ŏ ܋໔⌍⍮ኆЪᛈ㏗ য໏㍫
Ŏ ↦܋ࠎᖱⶳጓɗᐆ߉ⶳጓ
Ŏ #PUOFU $$TFSWFS
#PU
Ŏ ⹠ᑡ
Ŏ ዗ኄ֝⎛
ŏ

16. 17
㔃கਦͺդᴰ
Ŏ %FOJBMPG4FSWJDF
Ŏ
Ŏ ㍱᳐⇌ FKFDU
CFFQ
Ŏ
Ŏ ᎣᣳὈ᷒ ฆ༄ᏼጥ
Ŏ
^CJOTMFFQ]TCJOTMFFQ]VTSCJOTMFFQ
^CJOFKFDU
^FDIPF=B
^ZVNZVQEBUFCBTIBQUHFUZVQEBUFCBTISFCPPU

17. خ㌆㡯
} ⋴⶷⮇ў㎄഻஥ዄ⪁๲ᵛ ⼡഻୥ࢯኅ⋴⶷⮇ў˒
18
$(*ළͣⱽ㐩
Ŏ Ἅأ⿶↸዗ኄỉગష
Ŏ 㘓ాώक़ಅტᦡᡂͻ
Ŏ 71/
Ŏ 8FCDDFMFSBUPS
Ŏ /4
Ŏ .BJMTFSWFS
FUDŏ

18. Ṫ㟏
Ϯᖱ᫗☱භЎᐎࣞɗධЪ↫ɗҠς㑒
●ᏼጥCBTI㦎۟໅໅༚ḂΤ⎛⹜ⰬԆ
⋴⶷⮇ўṦպ̥ዕ㖉خ㌆⏻

19. 20
∺ђ㦑⎛⹜ⰬԆ܌ؐ
4IFMMTIPDL຺㔂

20. 2/1Ӷٷ٣஠ቖᇨ
⍮Ⱅⶳጓ
֞ܠ2/1чᷗ⓱ QPSUPOMZ
֤ᐊܠ/4
ܠώक़㕚㐖ͻ
܌౉ᝒ᲻㦑
21
ഀፄቭϘส
ጚ㍛㐷㋳˅

21. ͅᔉ㑊㌆
⾾⿧⎛⹜ⰬԆỉᦡᡂ؍ᷗ㦎
㘓ా⸬Ϟᦉ⾾Ϯᖱ֝ざ⎛⹜
㌷ʾֲ㍙㡽ˎ㎄ဌ።⋴⶷⮇ў⿂።QBUDIٶʾ

22. 23
ᓪђΧ
๲⑸ྻ࿞%)$1Ўᐎࣞ࿪ᒜ⿏⎸чᷗ⓱

23. 24
%)$1கဆℑ
ᔜϨ͡㦑ᶁ਴ⴳዾ
%)$1ЎᐎࣞԖ֜΍܃ዾ EEJUJPOBM0QUJPO
ᐆ⬦౲ؐᶁ਴ⴳዾͻ
ᔜϨΧ㦑ৎ⫤CBTI
ᒙα%)$1ాႮ↸ᐆԖᅅϝ⍤CBTIৎ⫤

25. 26
各作業系統 DHCP 連線受影響之概況ᐄ໏᣼ⱒᎇ㍹㦑
04 7FSTJPO 7VMOFSBCMF
$FOU04 :4
%FCJBO :4
'FEPSB :4
6CVOUV -54 :4
6CVOUV -54 :4
OESPJE /0
QQMFJ04 /0
'SFF#4% /0
(FOUPP /0 මҎ໢
-JOVY.JOU ʼn2JBOBŊ$JOOBNPO /0
-JOVY.JOU %FCJBO$JOOBNPO /0
.BD049 /0
PQFO464 /0
4ZOPMPHZ VQEBUF /0 මҎ໢

26. 27
㔃கਦͺդᴰ
Ŏ ᦉ⾾֝⎛
क़⬦዗㏱ỉᙜࣞͧ๲⑸ྻ࿞%)$1
Ўᐎࣞ
ể⾵ᛦ㘵Ⱆ⥣ⴸ֝⎛Ⴔᐊᙜࣞጩ⎸
֝⎛ᙜࣞㄒጥⲚឡ*1㗣ͧͻᄪ
ᦉ⾾ગㄔ֝⎛ᙜࣞ ⿆෤፽ᐄ㚙ᛈ㏗

27. 28
ᓪђͦ
␟⿧(JU4VCWFSTJPOЎᐎࣞỉTIFMM㏗ؕ

28. 29
(JU4VCWFSTJPO4FSWFSPWFS44)
Ŏ ܌ؐ㏗ؕ㦎ᬔ᠎ӛગざ׷ᅅϝ
ᷗ'PSDF$PNNBOE㏗ؕчᷗ⓱

29. 30
44)ͥ፦࠵
ᔜϨ͡㦑ᶁ਴ⴳዾ
TTINZTTITFSWFSDPNNBOE
!
44)⿏⎸ᎇDPNNBOE܃ዾᐆ⬦ఎ႔ᶁ਴ⴳ
ዾ44)@03*(*/-@$0../%
ᔜϨΧ㦑ৎ⫤CBTI
⌍⍮㔑ⰬTIFMM᫗CBTIᎇ㦎⿏⎸໏☱ٳࠝٳ
CBTI

30. 31
዗ኄḅ㒘Ⴆॎ

31. 32
㔃கਦͺդᴰ
Ŏ ␟⿧44)Ўᐎࣞ㏗ؕ
Ŏ ܋໔⌍⍮ኆЪᛈ㏗ য໏㍫
Ŏ ↦܋ɗ#PUOFU ܲأ

32. 33
ᓪђभ
዗ኄ.BJMЎᐎࣞ RNBJM

33. 34
RNBJMͥ፦࠵
ᔜϨ͡㦑ᶁ਴ⴳዾ
౔Ҋᎇઑ㔈ዾӇఎ႔ᶁ਴ⴳዾ㦎ђ૏౔Ϩ⓱
ᔜϨΧ㦑ৎ⫤CBTI
૏ᑷЎᐎࣞⰬ఺क़౔Ϩᎇчᷗ঍ॣҊ⿧ᩕ⼌
㚕ɗぢϨ؃⫵∫ᴑ⼌㚕⇳ᷗؐCBTIỉℨ๿㦎
ಙܟϞ؍ᷗ

34. 影⽚片網址 http://youtu.be/fxJBmruP0wQ

35. 36
㔃கਦͺդᴰ
Ŏ ܋໔⌍⍮ኆЪᛈ㏗ য໏㍫
Ŏ ↦܋ႴᐊぢϨⶳጓ
Ŏ #PUOFUɗ዗ኄ֝⎛ŏ ܲأ

36. ௠ቒᱪ
዗ኄчᷗ$(*ỉ⎛㔄Ўᐎࣞ
๲⑸ྻ࿞%)$1Ўᐎࣞ࿪ᒜ⿏⎸чᷗ⓱
␟⿧(JU4VCWFSTJPOЎᐎࣞỉTIFMM㏗ؕ
዗ኄ.BJMЎᐎࣞ RNBJM
37

37. 38
ऱၥ΍⿬

38. 39
ᏼጥ⌍⍮CBTI☶ᐄጥᯕ㦎ͷ㎬᠝፽݇
ᐊ໏⑂ᏼጥ㦊4IFMMTIPDLႪ᪪ώक़๮⑂㦋
⿧ᩕю᥃㦊*15BCMFT
*%4
8'㦋㦎㏄
∺⿶↸዗ኄ
⌍⍮ຘڠ㦎㏈ኅྻ࿞ᅅϝৎ⫤㦎ђ૏ч
ᷗ4-JOVY

39. 40
4-JOVY㏈ኅчᷗྻ࿞ᅅϝ

40. 41
ಉ⍓

41. 42
㘓ా؍ᷗ4IFMMTIPDLᦡᡂ܋໔⌍⍮ኆЪᛈ㏗ɘ
⾾⿧$(*ɗ%)$1ɗ44)⇳⿁໑࿪ᒜɘ
Ἅأ㘓ాώक़ಅტ֦ϒ؍ᷗ㣟㦎4IFMMTIPDL
ମ▕ᓪђ〔ᐆᏼઑɘ
͡α⎛⹜ⰬԆ૏/4෤⬦чᷗ⓱༚Ḃ㦎፽㚙
ۗ㐖⒢㦎ⲚϮᖱٛຘᚇᒩɘ
๲ⴢႴᐊVOYᶁ਴ᷔ޹↧ۙᏼጥCBTIɘ
㔑Ⱅᐆᐊᏼઑ㘓ాჶ֜CBTI۱ଁ⁃ᚇ⯏ɘ

42. 5IBOLT

43. 2㦈ͨہ✝