Quote:
Originally Posted by qasdfdsaq
But they would still have to have some way to spawn a Bash shell in the first place (i.e. have shell access) right? Seeing as SSH won't execute any commands or even provide an environment prior to authentication... Yet the CVE says authentication not required.
|
Don't need to already have shell access. You can do it through a a http request and spawn a remote shell.
Quote:
if (len(sys.argv)<4):
print "Usage: %s <host> <vulnerable CGI> <attackhost/IP>" % sys.argv[0]
print "Example: %s localhost /cgi-bin/test.cgi 10.0.0.1/8080" % sys.argv[0]
exit(0)
|
Can also be abused via a rogue DHCP server to exploit some linux distros and also apple macs. It's not just mod_cgi.