Date: Sun, 23 Sep 2001 14:10:31 -0400 From: The Anarcat <anarcat@anarcat.dyndns.org> To: David G Andersen <danderse@cs.utah.edu> Cc: Ian Smith <smithi@nimnet.asn.au>, Chris Byrnes <chris@JEAH.net>, security@FreeBSD.ORG Subject: Re: New worm protection Message-ID: <20010923141030.B546@shall.anarcat.dyndns.org> In-Reply-To: <200109231703.f8NH3NK24837@faith.cs.utah.edu> References: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> <200109231703.f8NH3NK24837@faith.cs.utah.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Sun, 23 Sep 2001, David G Andersen wrote:
> Use mod_rewrite to redirect all accesses to that script.
>
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
>
> (I haven't tested this syntax. Test it first. :)
Unfortunatly, I tested this using a text file, which is fine. Here, if I
try using a compiled C script (instead of a perl script, faster on a
small machine), the script gets dumped in binary form! Not executed!
GET /root.exe
ELF ð4ô4 (444ÀÀôôôvvxxx¬È´´´pp/usr/libexec/ld-elf.so.FreeBSDÀ¶
...
So I used the redirect approach:
RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.cgi
sleep.c:
int main() {
sleep(5);
printf("Content-type: text/plain\n\n");
}
This works. However, it generates a bit too much output:
GET /cmd.exe
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="/cgi-bin/sleep.cgi">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
</BODY></HTML>
;)
I really don't understand why the Rewrite rule doesn't work as expected.
A.
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
c+QAn324N8SSDAEyDviPsqrhDTujaXuP
=v3ql
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010923141030.B546>