Re: SSH brute force blocking tool

[gabriel rosenkoetter <gr () eclipsed net>]

On Mon, Nov 27, 2006 at 09:29:33PM +0000, Tavis Ormandy wrote:
> Gabriel, I was referring to this line:
>
> awk '!/#/ && /\./ && !a[$0]++
> {print "iptables -A INPUT -s "$1" -i eth0 -d '$ifaddr' -p TCP --dport 22
> -j REJECT"}' /etc/hosts.deny |\
> awk '/iptables/ && !/#/ && !/-s  -i/'|sh
>
> (note the |sh), $1 can be controlled by specially crafted attempted
> logins.

Aha.

Yep, sure can!

I couldn't find where the malicious input was actually executed, but
I didn't spend long looking.

I take back my take back.

-- 
gabriel rosenkoetter
gr () eclipsed net

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/