Re: [Full-disclosure] SSH brute force blocking tool

On Mon, Nov 27, 2006 at 09:29:33PM +0000, Tavis Ormandy wrote:
Gabriel, I was referring to this line:

awk '!/#/ && /\./ && !a[$0]++
{print "iptables -A INPUT -s "$1" -i eth0 -d '$ifaddr' -p TCP --dport 22
-j REJECT"}' /etc/hosts.deny |\
awk '/iptables/ && !/#/ && !/-s -i/'|sh

(note the |sh), $1 can be controlled by specially crafted attempted
logins.

Aha.

Yep, sure can!

I couldn't find where the malicious input was actually executed, but
I didn't spend long looking.

I take back my take back.

--
gabriel rosenkoetter
gr@xxxxxxxxxxxx

Attachment: pgpgky43zvaa9.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/