|
|
|
|
| |
| Xitami web server default's installation of the CGI bin directory contains a test CGI that allows remote users to view information regarding the operating system and web server's directory. |
| |
Credit:
The information has been provided by zer0-logic.
|
| |
Vulnerable systems:
Xitami WEB/FTP release 2.5b4
Example:
http://www.example.com/cgi-bin/testcgi
will produce the following output:
Environment Variables
COMPUTERNAME = MYSERVER
COMSPEC = C:\WINNT\system32\cmd.exe
HOMEDRIVE = C:
HOMEPATH = \
LOGONSERVER = \\MYSERVER
NUMBER_OF_PROCESSORS = 1
OS = Windows_NT
OS2LIBPATH = C:\WINNT\system32\os2\dll;
PATH = C:\WINNT\system32;C:\WINNT
PROCESSOR_ARCHITECTURE = x86
PROCESSOR_IDENTIFIER = x86 Family 6 Model 8 Stepping 3, GenuineIntel
PROCESSOR_LEVEL = 6
PROCESSOR_REVISION = 0803
SYSTEMDRIVE = C:
SYSTEMROOT = C:\WINNT
TEMP = C:\TEMP
TMP = C:\TEMP
USERDOMAIN = MYSERVER
USERNAME = Administrator
USERPROFILE = C:\WINNT\Profiles\Administrator
WINDIR = C:\WINNT
HTTP_ACCEPT_CHARSET = iso-8859-1,*,utf-8
HTTP_ACCEPT_LANGUAGE = en
HTTP_ACCEPT_ENCODING = gzip
HTTP_ACCEPT = image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*
HTTP_HOST = 127.0.0.1
HTTP_USER_AGENT = Mozilla/4.75 [en] (WinNT; U)
HTTP_CONNECTION = Keep-Alive
HTTP_CONTENT_LENGTH = 0
SERVER_SOFTWARE = Xitami
SERVER_VERSION = 2.5b4
SERVER_NAME = 127.0.0.1
SERVER_URL = http://127.0.0.1/
SERVER_PORT = 0
SERVER_PROTOCOL = HTTP/1.1
SERVER_SECURITY = -
GATEWAY_INTERFACE = CGI/1.1
REQUEST_METHOD = GET
QUERY_METHOD = GET
SCRIPT_PATH = cgi-bin
SCRIPT_NAME = /cgi-bin/testcgi
CONTENT_TYPE =
CONTENT_LENGTH = 0
REMOTE_USER = -
REMOTE_HOST = 127.0.0.1
REMOTE_ADDR = 127.0.0.1
PATH_INFO =
PATH_TRANSLATED = C:/Xitami/webpages
DOCUMENT_ROOT = C:/Xitami/webpages
CGI_ROOT = C:/Xitami/cgi-bin
CGI_URL = /cgi-bin
CGI_STDIN = C:\TEMP\pipe0001.cgi
CGI_STDOUT = C:\TEMP\pipe0001.cgo
CGI_STDERR = cgierr.log
Workaround:
Delete testcgi.exe file, or disable the cgi-bin directory in Xitami Administration under CGI properties configuration menu.
|
|
|
|
|
|
|
|
|
|
