first commit

bash/CVE-2014-6271/README.md

@@ -0,0 +1,25 @@
+# Bash Shellshock Remote Command Injection (CVE-2014-6271)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+Build and run the vulnerable environment：
+
+```
+docker compose build
+docker compose up -d
+```
+
+When you visit `http://your-ip/` you should see two files:
+
+ - safe.cgi
+ - victim.cgi
+
+safe.cgi generated by the latest version of bash, and victim.cgi is the page generated by bash4.3 which is vulnerable to shellshock.
+
+We can send include our payload in the user-agent string when visiting victim.cgi and the command is executed successfully:
+
+![](1.png)
+
+The same request sent to safe.cgi is unaffected:
+
+![](2.png)