4 ms·
I'm seeing exploit attempts against some very rarely used cgi programs that I happen to have installed: Clearly there are people out there who have trawled the
by pja 12y ago
I'm seeing exploit attempts against some very rarely used cgi programs that I happen to have installed: Clearly there are people out there who have trawled the entirety of the open source archives looking for potentially exploitable cgi scripts and are directly targeting hosts where those scripts can be found. Presumably they're using Google or other search engines to obtain lists of potentially exploitable hosts for a given vulnerable cgi script.
In this specific case, the exploit route is via the darcsweb.cgi python script which calls os.popen4() which in turn spawns /bin/sh. If /bin/sh had been bash it would have been all over for my server. This is not a cgi script in wide use (Debian popularity contest says that 22 people have installed it & registered with popcon!) yet it's still worth poking my server, which implies to me that this is an automated search of all the exploitable code they've found.
There's no security in obscurity here...
- Someone1234 12y agoThey're likely Googling stuff like: "darcsweb filetype:cgi" Or just "filetype:cgi" Interestingly Bing is either blocking "filetype:cgi" or their filetype moniker just doesn't work very well (I am actually leaning more towards the latter after some additional testing). Ditto with DDG, their filetype: filter just doesn't work at all.
- hyyypr 12y agoShodan[1] does just this. I guess script kiddies all around the world are abusing it. [1]:http://shodanhq.com/search?q=cgi http://shodanhq.com/search?q=cgi
- hyyypr 12y agoCorrect me if I'm wrong, but it seems that on Debian (7 at least) /bin/sh is a symbolic link to /bin/dash. The issue is so wide spread because usually /bin/sh links to /bin/bash... I don't know if Debian and Ubuntu are the only *nixes using Dash instead of Bash.
- sophacles 12y agoI'm not sure they are even googling for exploitable hosts. It's much easier to just enumerate IP space from a few hosts scattered around.