full-disclosure - Re: Apache 2.2.17 exploit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 5 Oct 2011 08:36:37 +1100
From: xD 0x41 <secn3t@...il.com>
To: halfdog <me@...fdog.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Apache 2.2.17 exploit?

Are there any ideas how to make the code more robust (currently
raciness due to frequent syscalls is problematid), smaller or add
features (I thought using the libc GOT, but this made code larger and
I do not know if that would make code much more portable)?

What about using libcurl/curlsetopt_url and the other curl options





On 5 October 2011 08:26, halfdog <me@...fdog.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Just for those, who want to build their own apache shell code for
> testing purposes, this snip might be of some use. It uses the still
> open tcp connections to the server to spawn the shells, so that no
> backconnect is needed. Of course, it does not give remote root but
> only httpd user privs. And you should send "exec 1>&0" as first
> command if you want to see remote shell stdout.
>
>
> Are there any ideas how to make the code more robust (currently
> raciness due to frequent syscalls is problematid), smaller or add
> features (I thought using the libc GOT, but this made code larger and
> I do not know if that would make code much more portable)?
>
>
> PS: There is no use to compile or run it, it is just embedded into .c
> file for compilation (too lazy to look up gcc args for .S assem)
> before insertion into vectors.
>
> - --
> http://www.halfdog.net/
> PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFOi3nbxFmThv7tq+4RAv8cAJ4tR3T2Ssx8SOYr5eDqX5OYqNyhmgCfbjd1
> f9X896pIjKEn/l/3ZLv1Ha8=
> =5K0l
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/