I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states

In monitoring the network activity between a critical Goldmine Tech web server and an untrusted foreign IP, Bob discovers the following HTTP GET request from the untrusted IP:

GET /cgi-bin/status/status.cgi HTTP/1.1
Host: motherlode.goldminetech.edu
User-Agent: () { :;}; echo "PWNED by 0c007: “ $(</etc/passwd)

I understand here a shell script injection is being used as the command $(</etc/passwd)is executed, giving the hacker access to this password folder. Then, an HTTP response is listed here:

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico
jdoe:*:202:1:John Doe:/home/jdoe:/usr/bin/ksh

I am supposed to determine what the hacker gained access to. Here is where I am stuck, as I cannot decipher this response. I have looked around and cannot find anything explaining how to read an HTTP response from a Linux server. Any help would be greatly appreciated.

  • 2
    bonus points for knowing what specific vulnerability was exploited :) – schroeder Oct 7 '15 at 22:43
  • you used the term "password folder" - please double check that is what you meant – schroeder Oct 7 '15 at 22:44
  • Its not a folder it's a file. This is not a XSS attack. Here the attacker injected code by manipulating the User-Agent Header – davidb Oct 7 '15 at 23:20

This is the content of the /etc/passwd file which contains the users of the system. It is separated from the password hashes, which are located in /etc/shadow. The attacker knows which accounts exist on the system. He can use that knowledge to bruteforce them and maybe deduce information about the system based on the usernames that are used by daemons.

  • The question is bad, not the answer. – sebix Oct 8 '15 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.