Re: Fernando Gont remote command execution and big mouth vulnerability

[Joxean Koret <joxeankoret () gmail com>]

Oh I see... ppl loves to put ur name in their websites ... HEH!!!


u removed the link in the tools (dig) section of:
http://www.gont.com.ar   nice try ....

http://thor.prohosting.com/fgont/cgi-bin/dig.pl
http://thor.prohosting.com/fgont/cgi-bin/whois.pl

also your dig script have a directory listing bug... just adding * in
the query....


   dig *
; <<>> DiG 8.3 <<>> cgi-lib.pl cli.pl dig.pl fuente.cgi p1.txt
p1dig.txt p1host.txt p1ns.txt p1whois.txt p2.txt p2dig.txt p2h
ost.txt p2ns.txt p2whois.txt whois.cgi whois.pl
;; res options: init recurs defnam dnsrch


------

                                                                Gont's
web site - Tools - whois (p1 of 13)

                    Web Hosting | Free Web Hosting | School Websites |
Teacher Websites | VChocolates
                    [banner_sign_up.gif]
                    Chocolates | Toffee | Caramels | Truffles | Search
| Heavy Equipment | Fitness |

                                                          Tools
                                                          whois


                            whois(1) manual page
     _______________________________________________________________________________________________________________

   whois ________________________________________
     _______________________________________________________________________________________________________________

   whois cat *
# Perl Routines to Manipulate CGI input
# cgi-lib () pobox com
# $Id: cgi-lib.pl,v 2.17 1998/05/14 22:39:23 brenner Exp $
#
# Copyright (c) 1993-1998 Steven E. Brenner
# Unpublished work.
# Permission granted to use and modify this library so long as the
# copyright above is maintained, modifications are documented, and
# credit is given for any use of the library.
#
# Thanks are due to many people for reporting bugs and suggestions
....

 Gont's web site
   Contact Fernando Gont at fernando () gont com ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando () gont com ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando () gont com ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando () gont com ar
   ELF D4瞻4 (444獸@獸@繫繫繫````禮`禮T獸X
禮禮簞簞/usr/libexec/ld-elf.so.1FreeBSDS%+ ' )(!& $*%"
#繡穡織':獸D/獸T#禮簽藩,瓣%1
   8繕簽藩癒繕穡`禮
     糧Df聶繕獸RT獸Yt織穡簽藩獸Yd�t癟+禱簷繪瞻L藩織W獸
   
W]$[h4繞libc.so.4warnx__stdoutpconnect_DYNAMICerrxoptargsocketfflushfreeaddrinfo_init_DefaultRuneLocalegai_strerrorenviron


......

"My site does not contan scripts" (since you removed the link).
"and is hosted on an OpenBSD server" Then fuck you and theo


Regards!!!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/