NullByte Exploitation

[Gonzalez]

NullByte Exploitation

CGI File Edition

Hopefully, you all have read my first nullbyte exploitation article and know what a nullbyte is. If you dont

know what it is and havent read my article the nullbyte is a string used in programming languages that

terminates the string. We will be using the nullbyte to trick a cgi file into displaying it's own code!

In this edition of nullbyte exploitation we will see how we are able to exploit perl cgi files on the web. The first

example shows of a cgi page that uses the following to access .html pages:

index.cgi?pageid=3

This, in turn, shows us 3.html. This is not a huge vulnerability, in itself. But, when we apply the nullbyte

something magical happends. A simple PoC i will show you is how we are able to view the source of

index.cgi. Look below for an example.

index.cgi?pageid=index.cgi%00

When we enter the null byte into the url it terminates everything so that the .html exrension is not put on.Although i havent tested this theory, but, we should be able to access /etc/passwd using this method.

index.cgi?pageid=/ect/passwd%00

Theoretically this should open up /etc/passwd and display the password file! Obviously, the possibilities from

this point are endless.

Thanks for reading!