Slashdot Mirror

← Back to Stories (view on slashdot.org)

Shell Simulation Via CGI

Posted by Hemos on from the playing-around dept.

mischi writes "CGI-Shell simulates a shell using CGI. So everybody who has a CGI-directory on a web-server, also has its own shell on it -- comparable with Telnet or SSH. That's really practical, because most webhosters don't offer a shell (for free) -- but do offer CGI. With CGI-Shell you can execute commands, copy files or just explore your webserver. Even a history and auto-completion with tabulator are included. "

3 of 332 comments (clear)

  1. Backdoors by TheGreek · · Score: 5, Interesting

    waiting to happen. Expect to see hosting providers outlaw this quickly, if they haven't done so in their ToSes already.

  2. UID issues by Ryu2 · · Score: 5, Interesting

    Most webserver setups run under a non-priveleged UID of 'nobody' or the like... which means that normally, the web server user would not be able to access files owned by YOUR own UID. Would there be some sort of set-UID involved here?

    --
    There's 10 types of people in this world, those who understand binary and those who don't.
  3. Stop whinging - this is a good thing by cliveholloway · · Score: 5, Interesting

    Any exploits that this allows idiots/script kiddies to do are exploits that a Perl programmer with half a brain can write in about 6 lines of code:

    use CGI;
    my $q=CGI->new();
    my $command = $q->param('command')
    $command and print $q->header('text/plain').`$command`."\n" and exit;
    print $q->header.$q->start_html.$q->start_form.$q->textf ield('command').$q->end_form.$q->end_html;

    If your web server is so badly configured that this creates security issues for you, you seriously need to read up on security.

    .02

    cLive ;-)

    --
    -- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism