Атака на сервер

[.Light.]

Подскажите как сделать атаку на сервер.

Нашел сервер Apache/2.2.22 (Ubuntu)

Нашел Acunetix показал что есть грубая ошибка на сервере.

Так вот как воспользоваться этой уязвимостью?

[blackbox]

.Light. said:
↑ (https://antichat.live/posts/3940572/)
Подскажите как сделать атаку на сервер.
Нашел сервер Apache/2.2.22 (Ubuntu)
Нашел Acunetix показал что есть грубая ошибка на сервере.
Так вот как воспользоваться этой уязвимостью?


Акунетикс и похожие сканеры часто парашу выдают, которую на практике не используешь. Нужно смотреть что он конкретно написал и дальше уже отталкиваясь от этой инфы решать, можно ли там что-то реализовать или это бесполезный баг "для галочки".

[Turanchocks_]

Для начала нужно знать - что за ошибка."Грубая ошибка на сервере" - это для маглов.

[r0b0t]

Просто возьми версию апача и пройдись по сплойтам, почитай что есть под эту ветку, не думаю что акунетикс покажет приватную багу, так что в гуле если и есть что то ты найдешь.

[grimnir]

https://vulners.com/search?query=Apache 2.2.22 (https://vulners.com/search?query=Apache%202.2.22)

[.Light.]

nginx SPDY heap buffer overflow

Vulnerability description

A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

This vulnerability affects Web Server.

Discovered by: Scripting (Version_Check.script).

Attack details

Current version is : nginx/1.4.6



Retest alert(s) (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)



Mark this alert as a false positive (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

The impact of this vulnerability

An attacker can cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution

How to fix this vulnerability

Upgrade nginx to the latest version of apply the patch provided by the vendor.

Classification

CWE (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/) CWE-122 (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

CVE (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/) CVE-2014-0133 (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

CVSS (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/) Base Score: 5.1 - AV:N/AC:H/Au:N/C/I/A/EOC/RL:OF (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Access Vector: Network (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Access Complexity: High (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Authentication: None (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Confidentiality Impact: Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Integrity Impact: Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Availability Impact: Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Exploitability: Proof of concept code (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

Remediation Level: Official fix (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)

[ZodiaX]

.Light. said:
↑ (https://antichat.live/posts/3940572/)
Нашел сервер Apache/2.2.22 (Ubuntu)




.Light. said:
↑ (https://antichat.live/posts/3941695/)
Current version is : nginx/1.4.6


Что то тут ни так!)

[.Light.]

ZodiaX said:
↑ (https://antichat.live/posts/3941734/)
Что то тут ни так!)


ДА это другой сервак, подскажите что делать дальше?

[ZodiaX]

.Light. said:
↑ (https://antichat.live/posts/3941783/)
ДА это другой сервак, подскажите что делать дальше?


Сплойта в паблике я не видел.

[r0b0t]

Кроме описаний к данной баги в сети нет ничего.

[nikbim96]

.Light. said:
↑ (https://antichat.live/posts/3941695/)
nginx SPDY heap buffer overflow
Vulnerability description
A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.
This vulnerability affects
Web Server
.
Discovered by: Scripting (Version_Check.script).
Attack details
Current version is : nginx/1.4.6


Retest alert(s) (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)


Mark this alert as a false positive (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
The impact of this vulnerability
An attacker can cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution
How to fix this vulnerability
Upgrade nginx to the latest version of apply the patch provided by the vendor.
Classification
CWE (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
CWE-122 (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
CVE (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
CVE-2014-0133 (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
CVSS (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Base Score:
5.1
-
AV:N/AC:H/Au:N/C/I/A/EOC/RL:OF (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Access Vector:
Network (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Access Complexity:
High (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Authentication:
None (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Confidentiality Impact:
Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Integrity Impact:
Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Availability Impact:
Partial (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Exploitability:
Proof of concept code (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)
Remediation Level:
Official fix (https://antichat.live/file_/C_/ProgramData/Acunetix_20WVS_2010/Data/Reporter/ReportItemTemp.xml/)



Вот почитай это на rapid7 CVE-2014-0133 (http://www.rapid7.com/db/vulnerabilities/nginx-cve-2014-0133)

посмотри есть нет на него exploit в metasploit.

Если есть то можно будет выполнить его вызвав переполнения буфера.