Full Disclosure mailing list archives
Re: Apache 2.2.17 exploit?
From: halfdog <me () halfdog net>
Date: Tue, 04 Oct 2011 21:26:21 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just for those, who want to build their own apache shell code for testing purposes, this snip might be of some use. It uses the still open tcp connections to the server to spawn the shells, so that no backconnect is needed. Of course, it does not give remote root but only httpd user privs. And you should send "exec 1>&0" as first command if you want to see remote shell stdout. Are there any ideas how to make the code more robust (currently raciness due to frequent syscalls is problematid), smaller or add features (I thought using the libc GOT, but this made code larger and I do not know if that would make code much more portable)? PS: There is no use to compile or run it, it is just embedded into .c file for compilation (too lazy to look up gcc args for .S assem) before insertion into vectors. - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFOi3nbxFmThv7tq+4RAv8cAJ4tR3T2Ssx8SOYr5eDqX5OYqNyhmgCfbjd1 f9X896pIjKEn/l/3ZLv1Ha8= =5K0l -----END PGP SIGNATURE-----
Attachment:
ForkPayload.c
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Apache 2.2.17 exploit?, (continued)
- Re: Apache 2.2.17 exploit? Dan Dart (Oct 03)
- Re: Apache 2.2.17 exploit? dave bl (Oct 03)
- Re: Apache 2.2.17 exploit? Sergito (Oct 03)
- Re: Apache 2.2.17 exploit? Dan Dart (Oct 03)
- Re: Apache 2.2.17 exploit? adam (Oct 03)
- Re: Apache 2.2.17 exploit? PsychoBilly (Oct 03)
- Re: Apache 2.2.17 exploit? Darren Martyn (Oct 03)
- Re: Apache 2.2.17 exploit? adam (Oct 03)
- Re: Apache 2.2.17 exploit? xD 0x41 (Oct 04)
- Re: Apache 2.2.17 exploit? Darren Martyn (Oct 04)
- Re: Apache 2.2.17 exploit? halfdog (Oct 04)
- Re: Apache 2.2.17 exploit? xD 0x41 (Oct 04)
- Re: Apache 2.2.17 exploit? Kai (Oct 04)
- Re: Apache 2.2.17 exploit? Andrew Farmer (Oct 04)
- Re: Apache 2.2.17 exploit? xD 0x41 (Oct 04)
- Re: Apache 2.2.17 exploit? Valdis . Kletnieks (Oct 04)
- Re: Apache 2.2.17 exploit? xD 0x41 (Oct 04)
- Re: Apache 2.2.17 exploit? xD 0x41 (Oct 04)
- Re: Apache 2.2.17 exploit? halfdog (Oct 04)
- Re: Apache 2.2.17 exploit? halfdog (Oct 04)
- Re: Apache 2.2.17 exploit? Andrew Farmer (Oct 04)