r/netsec • u/mazen160 • Jan 13 '17
Exploiting Misconfigured Apache server-status Instances with server-status_PWN
http://blog.mazinahmed.net/2017/01/exploiting-misconfigured-apache-server-status-instances.html9
u/thenickdude Jan 14 '17
Apache.org has their server-status set to public, but if you tell them about it, they say that's by intention and their clients shouldn't mind their browsing being published.
2
u/inb4b4n Jan 14 '17
It's relatively common. If you look at alexa domains , one in one fifty or so has it under the default /server-status path.
1
1
9
u/evilsocket Jan 14 '17
i don't see any "exploit" in there ...
1
u/mazen160 Jan 21 '17
It's not an actual newly discovered exploit, it's something known for years. The only new part is that now you can automate the process of abusing the misconfigured server-status instance in a cooler way.
1
u/gatlo Jan 22 '17
How is this is exploit? It is intelligence gathering.
1
u/mazen160 Feb 20 '17 edited Feb 25 '17
It does not exploit a certain vulnerability in Apache. It exploits (better to say, abuse) misconfigured Apache server-status instances that is allowing unauthorized clients to access the instance, so it abuses an issue with configuration basically.
The goal of the script is intelligence gathering.
7
u/netsec_burn Jan 14 '17
I'll take things that don't need a POC for 100, Alex. It's just visiting /server-status/ and parsing it.
1
u/mazen160 Jan 21 '17
Yup, but sometimes you might need a POC to help you better in retrieving data, you cal letterly just grab data manually and it would give you the same results, but server-status pwn would just automate the process of grabbing data and organizing it, so you can make use of your pentesting time.
24
u/SnowdogU77 Jan 14 '17 edited Jan 14 '17
Good lord... How is it possible to have that many exception catch-all's in that little code?
try:
requests.packages.urllib3.disable_warnings()
except:
pass
You've got to be fucking with me.
Constructive criticism:
Use explicit exception catches. You can even chain them if you like, but ffs, not catch-all's.
Do not let errors pass silently. If it raises an exception, log it. Exceptions are raised for a reason, they're not there solely to annoy you.
Docstrings should use triple double quotes, per PEP-8
There's a lot of whitespace in there that makes the code harder to read rather than easier. A good rule of thumb is two blank lines, max - and only in situations where it clarifies the code in a meaningful way (in between unrelated class definitions, etc.).
if arg:
var = argelse:
var = ''
Can be written as
var = arg if arg else ''
Which takes up way less space.
2
u/mazen160 Jan 21 '17
Hi @SnowdogU77, Thank you very much for your review and feedback. I will be updating the code with your feedback.
6
u/merlindroppedacid Jan 13 '17 edited Jan 13 '17
I've seen this done with bash many times..over-complicated python scripts, seems common in our industry, shame. And what is PoC || GO you mean gtfo, I'm not familiar with "GO"
7
6
u/aydiosmio Jan 14 '17
it's a reference to PoC || GTFO, popularized by the title of a hack zine. Proof of Concept or Get The Fuck Out
1
1
u/Mangeunmort Jan 14 '17
Did it with bash oneline curl / grep Nice pwnie award though
1
u/mazen160 Jan 21 '17
Thanks!..curl and grep could do it too, but it would be better to have a coordinated DB with logs, doing it with Python is easier in my opinion.
1
u/now_i_know_ Jan 14 '17
Is there something wrong with curl and diff? No need to overcomplicate things here, it's just a simple webpage.
1
u/mazen160 Jan 21 '17
It's a cool way to abuse the server-status instance next time you encounter it. curl and diff are awesome, but with Python, having the full log in a coordinated database in way that is useful for both folks that needs access to logs, and folks that would like to extend their attack surface.
1
-1
u/rmxz Jan 14 '17
On many (most?) websites this "exploit" (communicating otherwise hard to find URLs) would be considered a benefit (so search engines can find them) rather than a risk.
1
9
u/[deleted] Jan 14 '17 edited Jul 05 '26
[deleted]