bash26
Analyze the binary and identify vulnerabilities within initialize_shell_variables.
Function ghidra_open_server called with arguments: {"filepath":"/sandbox/bash26"}
Tool result
[
{
"type": "text",
"text": "Success"
}
]Function ghidra_search_functions_by_name called with arguments: {"filepath":"/sandbox/bash26","query":"initialize_shell_variables"}
Tool result
[
{
"type": "text",
"text": "initialize_shell_variables @ 00150230"
}
]Function ghidra_decompile_function called with arguments: {"filepath":"/sandbox/bash26","name_or_address":"00150230"}
Tool result
[
{
"type": "text",
"text": "Decompilation succeeded, and the artifact is saved at /sandbox/ghidra/decompiled_0x150230.txt. Please find the table of contents below. \n[{'funcName': 'create_variable_tables', 'lineNum': 34}, {'funcName': 'set_pwd', 'lineNum': 47}, {'funcName': 'set_if_not', 'lineNum': 48}, {'funcName': 'getpid', 'lineNum': 49}, {'funcName': 'set_if_not', 'lineNum': 50}, {'funcName': 'set_if_not', 'lineNum': 51}, {'funcName': 'set_if_not', 'lineNum': 53}, {'funcName': 'set_if_not', 'lineNum': 54}, {'funcName': 'set_if_not', 'lineNum': 56}, {'funcName': 'bind_variable', 'lineNum': 57}, {'funcName': 'setifs', 'lineNum': 58}, {'funcName': 'set_if_not', 'lineNum': 59}, {'funcName': 'set_if_not', 'lineNum': 60}, {'funcName': 'set_if_not', 'lineNum': 61}, {'funcName': 'set_if_not', 'lineNum': 62}, {'funcName': 'create_variable_tables', 'lineNum': 69}, {'funcName': 'find_variable', 'lineNum': 71}, {'funcName': 'bind_variable_internal', 'lineNum': 73}, {'funcName': 'adjust_shell_level', 'lineNum': 77}, {'funcName': 'set_ppid', 'lineNum': 78}, {'funcName': 'bind_variable', 'lineNum': 79}, {'funcName': 'getopts_reset', 'lineNum': 81}, {'funcName': 'bind_variable', 'lineNum': 82}, {'funcName': 'find_variable', 'lineNum': 86}, {'funcName': 'get_current_user_info', 'lineNum': 89}, {'funcName': 'bind_variable', 'lineNum': 91}, {'funcName': 'get_current_user_info', 'lineNum': 97}, {'funcName': 'strlen', 'lineNum': 100}, {'funcName': 'strlen', 'lineNum': 109}, {'funcName': 'find_variable', 'lineNum': 114}, {'funcName': 'get_variable_value', 'lineNum': 116}, {'funcName': 'strlen', 'lineNum': 117}, {'funcName': 'strlen', 'lineNum': 118}, {'funcName': 'sh_xmalloc', 'lineNum': 119}, {'funcName': 'strcpy', 'lineNum': 120}, {'funcName': 'strcpy', 'lineNum': 121}, {'funcName': 'strlen', 'lineNum': 125}, {'funcName': 'find_user_command', 'lineNum': 130}, {'funcName': 'full_pathname', 'lineNum': 132}, {'funcName': 'sh_xfree', 'lineNum': 133}, {'funcName': 'file_status', 'lineNum': 136}, {'funcName': 'find_variable', 'lineNum': 138}, {'funcName': 'get_variable_value', 'lineNum': 140}, {'funcName': 'make_absolute', 'lineNum': 142}, {'funcName': 'sh_canonpath', 'lineNum': 143}, {'funcName': 'sh_xfree', 'lineNum': 144}, {'funcName': 'get_current_user_info', 'lineNum': 150}, {'funcName': 'strlen', 'lineNum': 153}, {'funcName': 'sh_xmalloc', 'lineNum': 158}, {'funcName': 'strcpy', 'lineNum': 159}, {'funcName': 'bind_variable', 'lineNum': 161}, {'funcName': 'sh_xfree', 'lineNum': 162}, {'funcName': 'find_variable', 'lineNum': 163}, {'funcName': 'get_current_user_info', 'lineNum': 166}, {'funcName': 'bind_variable', 'lineNum': 168}, {'funcName': 'shell_version_string', 'lineNum': 170}, {'funcName': 'bind_variable', 'lineNum': 172}, {'funcName': 'unbind_variable', 'lineNum': 173}, {'funcName': 'make_new_variable', 'lineNum': 174}, {'funcName': 'array_create', 'lineNum': 175}, {'funcName': '__strcpy_chk', 'lineNum': 178}, {'funcName': 'strchr', 'lineNum': 179}, {'funcName': 'array_insert', 'lineNum': 184}, {'funcName': 'array_insert', 'lineNum': 185}, {'funcName': 'inttostr', 'lineNum': 186}, {'funcName': 'array_insert', 'lineNum': 187}, {'funcName': 'inttostr', 'lineNum': 188}, {'funcName': 'array_insert', 'lineNum': 189}, {'funcName': 'array_insert', 'lineNum': 190}, {'funcName': 'array_insert', 'lineNum': 191}, {'funcName': 'bind_variable', 'lineNum': 195}, {'funcName': 'find_variable', 'lineNum': 197}, {'funcName': 'find_variable', 'lineNum': 199}, {'funcName': 'find_variable', 'lineNum': 201}, {'funcName': 'posix_initialize', 'lineNum': 203}, {'funcName': 'posix_readline_initialize', 'lineNum': 205}, {'funcName': 'set_shellopts', 'lineNum': 207}, {'funcName': 'bash_tilde_expand', 'lineNum': 214}, {'funcName': 'set_if_not', 'lineNum': 215}, {'funcName': 'sh_xfree', 'lineNum': 216}, {'funcName': 'gettimeofday', 'lineNum': 218}, {'funcName': 'getpid', 'lineNum': 219}, {'funcName': 'find_variable', 'lineNum': 223}, {'funcName': 'find_variable', 'lineNum': 225}, {'funcName': 'sv_ignoreeof', 'lineNum': 227}, {'funcName': 'sv_history_control', 'lineNum': 230}, {'funcName': 'setup_history_ignore', 'lineNum': 231}, {'funcName': 'find_variable', 'lineNum': 232}, {'funcName': 'inttostr', 'lineNum': 239}, {'funcName': 'find_variable', 'lineNum': 240}, {'funcName': 'bind_variable', 'lineNum': 242}, {'funcName': 'inttostr', 'lineNum': 246}, {'funcName': 'find_variable', 'lineNum': 248}, {'funcName': 'bind_variable', 'lineNum': 250}, {'funcName': 'find_variable', 'lineNum': 253}, {'funcName': 'sv_xtracefd', 'lineNum': 255}, {'funcName': 'find_variable', 'lineNum': 257}, {'funcName': 'legal_number', 'lineNum': 259}, {'funcName': 'bind_variable', 'lineNum': 265}, {'funcName': 'bind_variable', 'lineNum': 268}, {'funcName': 'bind_variable', 'lineNum': 271}, {'funcName': 'bind_variable', 'lineNum': 274}, {'funcName': 'bind_variable', 'lineNum': 278}, {'funcName': 'bind_variable', 'lineNum': 282}, {'funcName': 'bind_variable', 'lineNum': 286}, {'funcName': 'bind_variable', 'lineNum': 290}, {'funcName': 'find_variable', 'lineNum': 293}, {'funcName': 'make_new_variable', 'lineNum': 295}, {'funcName': 'array_create', 'lineNum': 296}, {'funcName': 'find_variable', 'lineNum': 302}, {'funcName': 'make_new_variable', 'lineNum': 304}, {'funcName': 'array_create', 'lineNum': 305}, {'funcName': 'find_variable', 'lineNum': 312}, {'funcName': 'make_new_variable', 'lineNum': 314}, {'funcName': 'array_create', 'lineNum': 315}, {'funcName': 'find_variable', 'lineNum': 321}, {'funcName': 'make_new_variable', 'lineNum': 323}, {'funcName': 'array_create', 'lineNum': 324}, {'funcName': 'find_variable', 'lineNum': 330}, {'funcName': 'make_new_variable', 'lineNum': 332}, {'funcName': 'array_create', 'lineNum': 333}, {'funcName': 'find_variable', 'lineNum': 339}, {'funcName': 'make_new_variable', 'lineNum': 341}, {'funcName': 'array_create', 'lineNum': 342}, {'funcName': 'find_variable', 'lineNum': 348}, {'funcName': 'make_new_variable', 'lineNum': 350}, {'funcName': 'hash_create', 'lineNum': 351}, {'funcName': 'find_variable', 'lineNum': 357}, {'funcName': 'make_new_variable', 'lineNum': 359}, {'funcName': 'hash_create', 'lineNum': 360}, {'funcName': 'find_variable', 'lineNum': 366}, {'funcName': 'make_new_variable', 'lineNum': 368}, {'funcName': 'array_create', 'lineNum': 369}, {'funcName': '__stack_chk_fail', 'lineNum': 380}, {'funcName': 'strncmp', 'lineNum': 389}, {'funcName': 'strlen', 'lineNum': 390}, {'funcName': 'sh_xmalloc', 'lineNum': 391}, {'funcName': 'strcpy', 'lineNum': 392}, {'funcName': 'strcpy', 'lineNum': 394}, {'funcName': 'legal_identifier', 'lineNum': 395}, {'funcName': 'parse_and_execute', 'lineNum': 397}, {'funcName': 'hash_search', 'lineNum': 400}, {'funcName': 'bind_variable', 'lineNum': 410}, {'funcName': 'dcgettext', 'lineNum': 413}, {'funcName': 'report_error', 'lineNum': 414}, {'funcName': 'dcgettext', 'lineNum': 420}, {'funcName': 'report_error', 'lineNum': 421}, {'funcName': 'strcmp', 'lineNum': 425}, {'funcName': 'find_variable', 'lineNum': 426}, {'funcName': 'bind_variable', 'lineNum': 434}, {'funcName': 'legal_identifier', 'lineNum': 441}, {'funcName': 'strlen', 'lineNum': 463}, {'funcName': 'sh_xmalloc', 'lineNum': 464}, {'funcName': 'strcpy', 'lineNum': 465}]"
}
]Function ghidra_read_artifact called with arguments: {"artifact_path":"/sandbox/ghidra/decompiled_0x150230.txt"}
Tool result
[
{
"type": "text",
"text": "\nvoid initialize_shell_variables(char **env,int privmode)\n\n{\n char *pcVar1;\n char cVar2;\n long lVar3;\n undefined *puVar4;\n undefined *puVar5;\n __pid_t _Var6;\n int iVar7;\n uint uVar8;\n int iVar9;\n uint uVar10;\n SHELL_VAR *pSVar11;\n char *pcVar12;\n ARRAY *pAVar13;\n char *__dest;\n BUCKET_CONTENTS *pBVar14;\n HASH_TABLE *pHVar15;\n size_t sVar16;\n size_t sVar17;\n char *pcVar18;\n int iVar19;\n size_t bytes;\n char **ppcVar20;\n long in_FS_OFFSET;\n timeval tv;\n char b [12];\n char d [32];\n \n puVar4 = PTR_null_array_assign_00208ec8;\n lVar3 = *(long *)(in_FS_OFFSET + 0x28);\n create_variable_tables();\n pcVar18 = *env;\n ppcVar20 = env + 1;\njoined_r0x0015027f:\n pcVar12 = pcVar18;\n if (pcVar18 != (char *)0x0) {\nLAB_00150299:\n cVar2 = *pcVar18;\n pcVar18 = pcVar18 + 1;\n if (cVar2 != '\\0') goto LAB_00150290;\n goto LAB_001502a4;\n }\nLAB_001502b1:\n set_pwd();\n set_if_not(\"_\",dollar_vars[0]);\n dollar_dollar_pid = getpid();\n set_if_not(\"PATH\",\"/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.\");\n set_if_not(\"TERM\",\"dumb\");\n if (interactive_shell != 0) {\n set_if_not(\"PS1\",primary_prompt);\n set_if_not(\"PS2\",secondary_prompt);\n }\n set_if_not(\"PS4\",\"+ \");\n pSVar11 = bind_variable(\"IFS\",\" \\t\\n\",0);\n setifs(pSVar11);\n set_if_not(\"HOSTTYPE\",\"x86_64\");\n set_if_not(\"OSTYPE\",\"linux-gnu\");\n set_if_not(\"MACHTYPE\",\"x86_64-unknown-linux-gnu\");\n set_if_not(\"HOSTNAME\",current_host_name);\n if (interactive_shell != 0) {\n pcVar18 = \"60\";\n if (posixly_correct != 0) {\n pcVar18 = \"600\";\n }\n if (shell_variables == (VAR_CONTEXT *)0x0) {\n create_variable_tables();\n }\n pSVar11 = find_variable(\"MAILCHECK\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = bind_variable_internal(\"MAILCHECK\",pcVar18,global_variables->table,1,0);\n }\n pSVar11->attributes = pSVar11->attributes | 0x10;\n }\n adjust_shell_level(1);\n set_ppid();\n pSVar11 = bind_variable(\"OPTIND\",\"1\",0);\n pSVar11->attributes = pSVar11->attributes | 0x10;\n getopts_reset(0);\n bind_variable(\"OPTERR\",\"1\",0);\n sh_opterr = 1;\n if (login_shell == 1) {\n if (posixly_correct == 0) {\n pSVar11 = find_variable(\"HOME\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n if (current_user.home_dir == (char *)0x0) {\n get_current_user_info();\n }\n bind_variable(\"HOME\",current_user.home_dir,0);\n }\n if (login_shell != 1) goto LAB_00150435;\n }\n if (*shell_name == '/') goto LAB_001510d3;\n if (current_user.shell == (char *)0x0) {\n get_current_user_info();\n }\n pcVar18 = current_user.shell;\n sVar16 = strlen(current_user.shell);\n iVar7 = 0x2b5;\n bytes = sVar16 + 1;\n }\n else {\nLAB_00150435:\n if (*shell_name == '/') {\nLAB_001510d3:\n pcVar18 = shell_name;\n sVar16 = strlen(shell_name);\n iVar7 = 0x2b8;\n bytes = sVar16 + 1;\n }\n else if ((*shell_name == '.') && (shell_name[1] == '/')) {\n pSVar11 = find_variable(\"PWD\");\n if ((pSVar11 != (SHELL_VAR *)0x0) &&\n (pcVar18 = get_variable_value(pSVar11), pcVar18 != (char *)0x0)) {\n sVar16 = strlen(pcVar18);\n sVar17 = strlen(shell_name);\n pcVar12 = (char *)sh_xmalloc((long)(int)sVar16 + 1 + sVar17,\"variables.c\",0x2c3);\n strcpy(pcVar12,pcVar18);\n strcpy(pcVar12 + (int)sVar16,shell_name + 1);\n goto LAB_00150488;\n }\n pcVar18 = shell_name;\n sVar16 = strlen(shell_name);\n iVar7 = 0x2c8;\n bytes = sVar16 + 1;\n }\n else {\n pcVar18 = find_user_command(shell_name);\n if (pcVar18 != (char *)0x0) {\n pcVar12 = full_pathname(pcVar18);\n sh_xfree(pcVar18,\"variables.c\",0x2ee);\n goto LAB_00150488;\n }\n uVar10 = file_status(shell_name);\n if ((uVar10 & 2) != 0) {\n pSVar11 = find_variable(\"PWD\");\n if (pSVar11 != (SHELL_VAR *)0x0) {\n pSVar11 = (SHELL_VAR *)get_variable_value(pSVar11);\n }\n pcVar12 = make_absolute(shell_name,(char *)pSVar11);\n if ((*shell_name == '.') && (pcVar18 = sh_canonpath(pcVar12,3), pcVar18 != (char *)0x0)) {\n sh_xfree(pcVar12,\"variables.c\",0x2df);\n pcVar12 = pcVar18;\n }\n goto LAB_00150488;\n }\n if (current_user.shell == (char *)0x0) {\n get_current_user_info();\n }\n pcVar18 = current_user.shell;\n sVar16 = strlen(current_user.shell);\n iVar7 = 0x2e8;\n bytes = sVar16 + 1;\n }\n }\n pcVar12 = (char *)sh_xmalloc(bytes,\"variables.c\",iVar7);\n pcVar12 = strcpy(pcVar12,pcVar18);\nLAB_00150488:\n bind_variable(\"BASH\",pcVar12,0);\n sh_xfree(pcVar12,\"variables.c\",0x205);\n pSVar11 = find_variable(\"SHELL\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n if (current_user.shell == (char *)0x0) {\n get_current_user_info();\n }\n bind_variable(\"SHELL\",current_user.shell,0);\n }\n pcVar12 = shell_version_string();\n pcVar18 = (char *)0x0;\n bind_variable(\"BASH_VERSION\",pcVar12,0);\n unbind_variable(\"BASH_VERSINFO\");\n pSVar11 = make_new_variable(\"BASH_VERSINFO\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 4;\n pSVar11->value = (char *)pAVar13;\n __strcpy_chk(d,dist_version,0x20);\n pcVar12 = strchr(d,0x2e);\n if (pcVar12 != (char *)0x0) {\n *pcVar12 = '\\0';\n pcVar18 = pcVar12 + 1;\n }\n array_insert(pAVar13,0,d);\n array_insert(pAVar13,1,pcVar18);\n pcVar18 = inttostr((long)patch_level,b,0xc);\n array_insert(pAVar13,2,pcVar18);\n pcVar18 = inttostr((long)build_version,b,0xc);\n array_insert(pAVar13,3,pcVar18);\n array_insert(pAVar13,4,release_status);\n array_insert(pAVar13,5,\"x86_64-unknown-linux-gnu\");\n pcVar18 = command_execution_string;\n pSVar11->attributes = pSVar11->attributes | 2;\n if (pcVar18 != (char *)0x0) {\n bind_variable(\"BASH_EXECUTION_STRING\",pcVar18,0);\n }\n pSVar11 = find_variable(\"POSIXLY_CORRECT\");\n if (((pSVar11 != (SHELL_VAR *)0x0) ||\n (pSVar11 = find_variable(\"POSIX_PEDANTIC\"), pSVar11 != (SHELL_VAR *)0x0)) &&\n ((pSVar11->attributes & 0x8000) != 0)) {\n pSVar11 = find_variable(pSVar11->name);\n posixly_correct = (int)(pSVar11 != (SHELL_VAR *)0x0);\n posix_initialize(posixly_correct);\n if (interactive_shell != 0) {\n posix_readline_initialize(posixly_correct);\n }\n set_shellopts();\n }\n if (remember_on_history != 0) {\n pcVar18 = \"~/.bash_history\";\n if (posixly_correct != 0) {\n pcVar18 = \"~/.sh_history\";\n }\n pcVar18 = bash_tilde_expand(pcVar18,0);\n set_if_not(\"HISTFILE\",pcVar18);\n sh_xfree(pcVar18,\"variables.c\",0x227);\n }\n gettimeofday((timeval *)&tv,(__timezone_ptr_t)0x0);\n _Var6 = getpid();\n last_random_value = 0;\n rseed = (long)_Var6 ^ tv.tv_sec ^ tv.tv_usec;\n if (interactive_shell != 0) {\n pSVar11 = find_variable(\"IGNOREEOF\");\n if (((pSVar11 != (SHELL_VAR *)0x0) ||\n (pSVar11 = find_variable(\"ignoreeof\"), pSVar11 != (SHELL_VAR *)0x0)) &&\n ((pSVar11->attributes & 0x8000) != 0)) {\n sv_ignoreeof(pSVar11->name);\n }\n if ((interactive_shell != 0) && (remember_on_history != 0)) {\n sv_history_control(\"HISTCONTROL\");\n setup_history_ignore(\"HISTIGNORE\");\n pSVar11 = find_variable(\"HISTTIMEFORMAT\");\n if ((pSVar11 != (SHELL_VAR *)0x0) && (history_comment_char == '\\0')) {\n history_comment_char = '#';\n }\n history_write_timestamps = (int)(pSVar11 != (SHELL_VAR *)0x0);\n }\n }\n pcVar18 = inttostr((ulong)current_user.uid,d,0xb);\n pSVar11 = find_variable(\"UID\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = bind_variable(\"UID\",pcVar18,0);\n pSVar11->attributes = pSVar11->attributes | 0x12;\n }\n if (current_user.euid != current_user.uid) {\n pcVar18 = inttostr((ulong)current_user.euid,d,0xb);\n }\n pSVar11 = find_variable(\"EUID\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = bind_variable(\"EUID\",pcVar18,0);\n pSVar11->attributes = pSVar11->attributes | 0x12;\n }\n pSVar11 = find_variable(\"BASH_XTRACEFD\");\n if ((pSVar11 != (SHELL_VAR *)0x0) && ((pSVar11->attributes & 0x8000) != 0)) {\n sv_xtracefd(pSVar11->name);\n }\n pSVar11 = find_variable(\"SECONDS\");\n if (pSVar11 != (SHELL_VAR *)0x0) {\n iVar7 = legal_number(pSVar11->value,&seconds_value_assigned);\n if (iVar7 == 0) {\n seconds_value_assigned = 0;\n }\n pSVar11 = (SHELL_VAR *)pSVar11->value;\n }\n pSVar11 = bind_variable(\"SECONDS\",(char *)pSVar11,0);\n pSVar11->dynamic_value = get_seconds;\n pSVar11->assign_func = assign_seconds;\n pSVar11 = bind_variable(\"BASH_COMMAND\",(char *)0x0,0);\n pSVar11->dynamic_value = get_bash_command;\n pSVar11->assign_func = (sh_var_assign_func_t *)0x0;\n pSVar11 = bind_variable(\"BASH_SUBSHELL\",(char *)0x0,0);\n pSVar11->dynamic_value = get_subshell;\n pSVar11->assign_func = assign_subshell;\n pSVar11 = bind_variable(\"RANDOM\",(char *)0x0,0);\n pSVar11->attributes = pSVar11->attributes | 0x10;\n pSVar11->dynamic_value = get_random;\n pSVar11->assign_func = assign_random;\n pSVar11 = bind_variable(\"LINENO\",(char *)0x0,0);\n pSVar11->attributes = pSVar11->attributes | 0x10;\n pSVar11->dynamic_value = get_lineno;\n pSVar11->assign_func = assign_lineno;\n pSVar11 = bind_variable(\"BASHPID\",(char *)0x0,0);\n pSVar11->attributes = pSVar11->attributes | 0x12;\n pSVar11->dynamic_value = get_bashpid;\n pSVar11->assign_func = null_assign;\n pSVar11 = bind_variable(\"HISTCMD\",(char *)0x0,0);\n pSVar11->attributes = pSVar11->attributes | 0x10;\n pSVar11->dynamic_value = get_histcmd;\n pSVar11->assign_func = (sh_var_assign_func_t *)0x0;\n pSVar11 = bind_variable(\"COMP_WORDBREAKS\",(char *)0x0,0);\n pSVar11->dynamic_value = get_comp_wordbreaks;\n pSVar11->assign_func = assign_comp_wordbreaks;\n pSVar11 = find_variable(\"DIRSTACK\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"DIRSTACK\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 4;\n pSVar11->value = (char *)pAVar13;\n pSVar11->dynamic_value = get_dirstack;\n pSVar11->assign_func = assign_dirstack;\n }\n pSVar11 = find_variable(\"GROUPS\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"GROUPS\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x4004;\n pSVar11->value = (char *)pAVar13;\n puVar5 = PTR_null_array_assign_00208ec8;\n pSVar11->dynamic_value = get_groupset;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar5;\n }\n pSVar11 = find_variable(\"BASH_ARGC\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_ARGC\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x6004;\n pSVar11->value = (char *)pAVar13;\n pSVar11->dynamic_value = get_self;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar4;\n }\n pSVar11 = find_variable(\"BASH_ARGV\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_ARGV\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x6004;\n pSVar11->value = (char *)pAVar13;\n pSVar11->dynamic_value = get_self;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar4;\n }\n pSVar11 = find_variable(\"BASH_SOURCE\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_SOURCE\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x6004;\n pSVar11->value = (char *)pAVar13;\n pSVar11->dynamic_value = get_self;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar4;\n }\n pSVar11 = find_variable(\"BASH_LINENO\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_LINENO\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x6004;\n pSVar11->value = (char *)pAVar13;\n pSVar11->dynamic_value = get_self;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar4;\n }\n pSVar11 = find_variable(\"BASH_CMDS\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_CMDS\",global_variables->table);\n pHVar15 = hash_create(0);\n pSVar11->attributes = pSVar11->attributes | 0x20040;\n pSVar11->value = (char *)pHVar15;\n pSVar11->dynamic_value = get_hashcmd;\n pSVar11->assign_func = assign_hashcmd;\n }\n pSVar11 = find_variable(\"BASH_ALIASES\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"BASH_ALIASES\",global_variables->table);\n pHVar15 = hash_create(0);\n pSVar11->attributes = pSVar11->attributes | 0x20040;\n pSVar11->value = (char *)pHVar15;\n pSVar11->dynamic_value = get_aliasvar;\n pSVar11->assign_func = assign_aliasvar;\n }\n pSVar11 = find_variable(\"FUNCNAME\");\n if (pSVar11 == (SHELL_VAR *)0x0) {\n pSVar11 = make_new_variable(\"FUNCNAME\",global_variables->table);\n pAVar13 = array_create();\n pSVar11->attributes = pSVar11->attributes | 0x5004;\n pSVar11->value = (char *)pAVar13;\n puVar4 = PTR_null_array_assign_00208ec8;\n pSVar11->dynamic_value = get_funcname;\n pSVar11->assign_func = (sh_var_assign_func_t *)puVar4;\n }\n if (lVar3 == *(long *)(in_FS_OFFSET + 0x28)) {\n return;\n }\n /* WARNING: Subroutine does not return */\n __stack_chk_fail();\nLAB_00150290:\n if (cVar2 != '=') goto LAB_00150299;\n iVar7 = (int)pcVar18 - (int)pcVar12;\n iVar19 = iVar7 + -1;\n if (iVar19 != 0) {\n pcVar1 = pcVar12 + iVar19;\n *pcVar1 = '\\0';\n if (((privmode == 0 && read_but_dont_execute == 0) && (*pcVar18 == '(')) &&\n (iVar9 = strncmp(\"() {\",pcVar18,4), iVar9 == 0)) {\n sVar16 = strlen(pcVar18);\n __dest = (char *)sh_xmalloc((long)(iVar7 + 2 + (int)sVar16),\"variables.c\",0x163);\n strcpy(__dest,pcVar12);\n __dest[iVar19] = ' ';\n strcpy(__dest + (long)iVar19 + 1,pcVar18);\n iVar7 = legal_identifier(pcVar12);\n if (iVar7 != 0) {\n parse_and_execute(__dest,pcVar12,0x185);\n }\n pHVar15 = shell_functions;\n pBVar14 = hash_search(pcVar12,shell_functions,0);\n if (pBVar14 != (BUCKET_CONTENTS *)0x0) {\n pSVar11 = (SHELL_VAR *)pBVar14->data;\n last_table_searched = pHVar15;\n if (pSVar11 != (SHELL_VAR *)0x0) {\n pSVar11->attributes = pSVar11->attributes | 0x8001;\n array_needs_making = 1;\n goto LAB_00150a5d;\n }\n }\n pSVar11 = bind_variable(pcVar12,pcVar18,0);\n if (pSVar11 == (SHELL_VAR *)0x0) {\n last_command_exit_value = L'\\x01';\n pcVar18 = (char *)dcgettext(0,\"error importing function definition for `%s\\'\",5);\n report_error(pcVar18,pcVar12);\n goto LAB_00150ae0;\n }\n pSVar11->attributes = pSVar11->attributes | 0x9001;\n array_needs_making = 1;\n last_command_exit_value = L'\\x01';\n pcVar18 = (char *)dcgettext(0,\"error importing function definition for `%s\\'\",5);\n report_error(pcVar18,pcVar12);\n }\n else {\n if (((posixly_correct == 0) || (*pcVar12 != 'S')) ||\n ((iVar7 = strcmp(pcVar12,\"SHELLOPTS\"), iVar7 != 0 ||\n (pSVar11 = find_variable(\"SHELLOPTS\"), pSVar11 == (SHELL_VAR *)0x0)))) {\n uVar10 = 0;\n }\n else {\n uVar10 = pSVar11->attributes;\n pSVar11->attributes = uVar10 & 0xfffffffd;\n uVar10 = uVar10 >> 1 & 1;\n }\n pSVar11 = bind_variable(pcVar12,pcVar18,0);\n if (pSVar11 == (SHELL_VAR *)0x0) {\nLAB_00150ae0:\n *pcVar1 = '=';\n pcVar18 = *ppcVar20;\n goto joined_r0x00150aef;\n }\n iVar7 = legal_identifier(pcVar12);\n if (iVar7 == 0) {\n uVar8 = pSVar11->attributes | 0x9001;\n }\n else {\n uVar8 = pSVar11->attributes | 0x8001;\n }\n array_needs_making = 1;\n pSVar11->attributes = uVar10 * 2 | uVar8;\n }\nLAB_00150a5d:\n *pcVar1 = '=';\n if ((pSVar11->attributes & 8) == 0) goto code_r0x00150a6d;\n }\nLAB_001502a4:\n pcVar18 = *ppcVar20;\njoined_r0x00150aef:\n ppcVar20 = ppcVar20 + 1;\n pcVar12 = pcVar18;\n if (pcVar18 == (char *)0x0) goto LAB_001502b1;\n goto LAB_00150299;\ncode_r0x00150a6d:\n sVar16 = strlen(pcVar12);\n pcVar18 = (char *)sh_xmalloc(sVar16 + 1,\"variables.c\",0x1ad);\n pcVar18 = strcpy(pcVar18,pcVar12);\n pSVar11->exportstr = pcVar18;\n pcVar18 = *ppcVar20;\n ppcVar20 = ppcVar20 + 1;\n goto joined_r0x0015027f;\n}\n\n"
}
]- Vulnerable to environment function importing ("Shellshock"): parses env vars of form
VAR=() { ... };, usesparse_and_executeunsafely, enabling code injection. - Multiple unchecked calls to
strcpy(pcVar12,__dest, and others) on env-provided/user-derived input, risking buffer overflows if input is not properly validated. - Insufficient validation/length checks in other variables copied from environment may permit exploitation in crafted configurations.
Explain how the Shellshock might happen
- Environment variables in the form
VAR=() { :; }; <malicious-code>are passed to Bash. initialize_shell_variablesdetects()and{, then callsparse_and_executeon the function definition.- The trailing
<malicious-code>executes immediately as arbitrary commands due to improper separation and validation, enabling remote code execution.
