1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
|
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <syslog.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <pwd.h>
#define VHOST_ROOT "/var/www/vhosts"
#define SITES_ROOT "/var/www/sites"
#define CGI "cgi-bin"
#define SERVER "epochttpd/2.0 (Unix)"
// WARNING: this http software is vulnerable. I'm leaving it that way.
/* just notes for environment variables for CGIs when I need them.
Key Value
_ DOCUMENT_ROOT The root directory of your server
x HTTP_COOKIE The visitor's cookie, if one is set
x HTTP_HOST The hostname of the page being attempted
x HTTP_REFERER The URL of the page that called your program
x HTTP_USER_AGENT The browser type of the visitor
_ HTTPS "on" if the program is being called through a secure server
x PATH The system path your server is running under
x QUERY_STRING The query string (see GET, below)
x REMOTE_ADDR The IP address of the visitor
x REMOTE_HOST The hostname of the visitor (if your server has
reverse-name-lookups on; otherwise this is the IP address again)
x REMOTE_PORT The port the visitor is connected to on the web server
_ REMOTE_USER The visitor's username (for .htaccess-protected pages)
x REQUEST_METHOD GET or POST
_ REQUEST_URI The interpreted pathname of the requested document or CGI
(relative to the document root)
_ SCRIPT_FILENAME The full pathname of the current CGI
_ SCRIPT_NAME The interpreted pathname of the current CGI (relative to
the document root)
x SERVER_ADMIN The email address for your server's webmaster
x SERVER_NAME Your server's fully qualified domain name (e.g.
www.cgi101.com)
x SERVER_PORT The port number your server is listening on
x SERVER_SOFTWARE The server software you're using (e.g. Apache 1.3)
*/
void standard_headers() {
printf("Server: %s\r\n",SERVER);
printf("Connection: close\r\n");
}
int main(int argc,char *argv[]) {
int fd;
char tmp[512];
char *name[10];
int s,n;
char *method;
char *page;
char *version;
char *get_param;
struct passwd *pwd;
char line[getpagesize()];
fgets(line,sizeof(line)-1,stdin);
struct sockaddr_in6 sa6;
unsigned int sl=sizeof(sa6);
char h[NI_MAXHOST];
char p[NI_MAXSERV];
openlog("httpd",LOG_PID,LOG_DAEMON);
if(getpeername(0,(struct sockaddr *)&sa6,&sl) == -1)
syslog(LOG_WARNING,"getpeername: %m");
getnameinfo((struct sockaddr *)&sa6,sl,h,sizeof(h),p,sizeof(p),NI_NUMERICHOST|NI_NUMERICSERV);
setenv("REMOTE_ADDR",h,1);
setenv("REMOTE_PORT",p,1);
if((pwd=getpwuid(getuid()))) setenv("USER",pwd->pw_name,1);
if(gethostname(h,NI_MAXHOST) != -1) setenv("HOST",h,1);
if(getsockname(0,(struct sockaddr *)&sa6,&sl) == -1)
syslog(LOG_WARNING,"getsockname: %m");
getnameinfo((struct sockaddr *)&sa6,sl,h,sizeof(h),p,sizeof(p),NI_NUMERICHOST|NI_NUMERICSERV);
setenv("SERVER_ADDR",h,1);
setenv("SERVER_HOST",h,1);//only IP for now
setenv("SERVER_PORT",p,1);
setenv("SERVER_SOFTWARE",SERVER,1);
if(!strchr(line,'\n')) {
printf("HTTP/1.1 413 Entity Too Large\r\n");
standard_headers();
printf("Content-type: text/plain\r\n\r\n");
printf("use smaller (<%d bytes) headers.\n",getpagesize());
syslog(LOG_WARNING,"413 Entity Too Large %s len: %d\n",h,strlen(line));
return 0;
}
if(strchr(line,'\r')) *strchr(line,'\r')=0;
method=strdup(line);
if((page=strchr(method,' '))) {
*page=0;
page++;
if((version=strchr(page,' '))) {
*version=0;
version++;
}
if((get_param=strchr(page,'?'))) {
*get_param=0;
get_param++;
setenv("QUERY_STRING",get_param,1);
}
}
signal(SIGALRM,exit);
alarm(10);//maximum of 10s to receive requests sound good?
while(fgets(line,sizeof(line)-1,stdin)) {
if(!strchr(line,'\n')) {
printf("HTTP/1.1 413 Entity Too Large\r\n");
standard_headers();
printf("Content-type: text/plain\r\n\r\n");
printf("use smaller (<%d bytes) headers.\n",getpagesize());
syslog(LOG_WARNING,"413 somewhere in request line 2+: %s %d\n",h,strlen(line));
return 0;
}
if(strchr(line,'\r')) *strchr(line,'\r')=0;
if(!strncasecmp(line,"Referer: ",9)) {
setenv("HTTP_REFERER",line+9,1);
}
if(!strncasecmp(line,"Cookie: ",8)) {
setenv("HTTP_COOKIE",line+8,1);
}
if(!strncasecmp(line,"Host: ",6)) {
setenv("HTTP_HOST",line+6,1);
}
if(!strncasecmp(line,"User-agent: ",12)) {
setenv("HTTP_USER_AGENT",line+12,1);
}
if(!strcmp(line,"")) {
break;
}
}
alarm(0);//no more timeout.
//
syslog(LOG_WARNING,"%s: %s %s %s %s\n",h,getenv("HTTP_HOST"),getenv("HTTP_USER_AGENT"),page,get_param);
//TODO: sanitize this.
if(chdir(VHOST_ROOT) == -1) {
printf("HTTP/1.1 500 Internal Server Error\r\n");
standard_headers();
printf("Content-type: text/html\r\n\r\ncouldn't chdir(\"%s\");",VHOST_ROOT);
syslog(LOG_WARNING,"can't chdir to VHOST_ROOT: %s",VHOST_ROOT);
exit(3);
}
//I had fun exploiting this. :)
if(chdir((char*)getenv("HTTP_HOST")) == -1) {
if(chdir(SITES_ROOT) != -1) {
if(chdir("default") == -1) {
//no backup site to show people. fuck. shit happens.
printf("HTTP/1.1 500 Internal Server Error\r\n");
standard_headers();
printf("Content-type: text/html\r\n\r\nfuck");
syslog(LOG_WARNING,"can't chdir to default site dir.");
exit(1);
}
//we're good.
} else {
printf("HTTP/1.1 500 Internal Server Error\r\n");
standard_headers();
printf("Content-type: text/html\r\n\r\ncouldn't chdir(\"%s\");",SITES_ROOT);
//wtf? no sites dir???
syslog(LOG_WARNING,"can't chdir to SITES_ROOT: %s",SITES_ROOT);
exit(2);
}
}
snprintf(tmp,sizeof(tmp),"webmaster@%s",getenv("HTTP_HOST"));
setenv("SERVER_NAME",getenv("HTTP_HOST"),1);
setenv("SERVER_ADMIN",tmp,1);
if(strncmp(page,"/cgi-bin/",9)) {
for(;*page == '/';page++);
if(page[strlen(page)-1] == '/') {
printf("HTTP/1.1 302 Moved Permanently\r\n");
standard_headers();
printf("Location: /%sindex.html\r\n\r\n",page);
return 0;
}
if((fd=open(page,O_RDONLY)) != -1) {//need to check that the file isn't a directory. :P
printf("HTTP/1.1 200 OK\r\n");
standard_headers();
name[0]="/usr/local/bin/mime-type";
name[1]=page;
name[2]=0;
printf("Content-type: ");
fflush(stdout);
switch(fork()) {
case 0://child
execv(name[0],name);
break;
case -1://error
printf("fork failed.\n");
break;
default://parent
break;
}
wait(&s);
fflush(stdout);
printf("\r\n");
fflush(stdout);
while((n=read(fd,line,sizeof(line)-1)) > 0) {
write(STDOUT_FILENO,line,n);
}
} else {
printf("HTTP/1.1 404 Not Found\r\n");
standard_headers();
printf("Content-type: text/plain\r\n\r\n");
printf("Can't open that page.\n");
}
} else {
//attempt to run this bastard!
chdir(CGI);
page+=strlen("/cgi-bin/");
for(;*page == '/';page++);
name[0]=page;
name[1]=0;
printf("HTTP/1.1 200 OK\r\n");
standard_headers();
fflush(stdout);
if(!strcmp(method,"GET")) close(STDIN_FILENO);
execv(name[0],name);
}
return 0;
}
|
