World: r3wp

well, I still think it's safe :)

another try, Pekr does not find a new file.

probe read/custom http://www.cod-okna.cz/cgi-bin/rebolprobe [

 post {write %exploited.txt "Ooops" print "content-type: text/plain^/^/oho^/"}
]

-> i hope does not find.

no new rebols in ps - aux output yet :-)

No, that should only run, make a file in rebols dir and quit. Hmm, 
in the current dir, where is that?

no files in-there ....

then Graham is right i think. although i would not do it :)

well, but it is good option to simply make nearly whatever provider 
a rebol hoster :-)

I think that it is legitimate aproach though. IIRC, my first article 
I read in some 1996 regarding cgi, was stating something like - put 
your C app into cgi-bin directory. Back then the author was describing 
that cgi is simply common gateway interface, and that your executable 
app should be put in cgi-bin directory. And rebol is C app :-)

Petr: <<I mean - above block in 'join statement is reduced - is it 
secure?>>

That should be okay.  You could just do a construct/with to create 
an object.

If you are intending to create an object, then pre-process the block 
from decode-cgi to ensure that the word "self" is not used as a keyword 
(tip courtesy of Chris RG, if I remember rightly).

Not sure. Maybe he means main app?

i mean a main app in c.

thanks guys ....

wait! how many sleeping rebols do you want?

url: http://www.cod-okna.cz/cgi-bin/rebol
print "should be fast"
probe attempt[ read probe url]  ; 
print "should be slow"
probe attempt[ 
 read/custom  url probe [
  post {wait 4^/}
 ]
]

and? You are imo reading rebol executable, that is all :-)

he's trying to start it up and leave a console running

No, the second time i do a wait. that should be slower.

ah, but the console would have to get that command (wait 4) - do 
you think it is passed to it?

I think so.

but hard to exploit more. security is on, so only access to cgi-bin 
and childs. cgi-bin should not be writable by the cgi-user. except 
if cgis run as your account, then i could write a script with -cs 
and call that in the next step.

and getting data out does not work, because rebol first prints its 
version-stuff, and webserver thinks "header wrong"

ok, just tried it - Volker is right ...

I can see processes, for one read/custom two of them - dunno why 
...

but you could flood server, running hundreds of instances .... keeping 
them in memory for long time ...

now - is it a rebol vulnerability? Or just putting rebol into cgi-bin 
is the simple cause?

Yes, but i could also call hundreds of regular scripts to keep server 
busy. although this way is  easier, i can allocate lots of mem with 
one call.

I would say: do no exe in cgi if it cant handle cgi. and rebol cant 
(except with script).

but it could protect itself by checking for cgi without -c? So not 
a bug, but a missing feature?

do no exe in cgi -> put no exe in cgi-bin

security through obsfuscation .. rename your rebol binary !

how could it protect itself? How does it know it is in place to be 
run as a cgi interpreter?

Hmm, good question. May be hard.

Graham - my server is far from popular. I think no-one will do Volker's 
like trick. But you might be right, if we teach ppl to simply put 
rebol into cgi-bin dir, and then such "vulnerability" is found, ISPs 
might hate it ....

renaming executable might work ... sufficiently enough imo ...

I see no reason why not to put it somewhere else, outside of web-folders.

Hosts wont' normally put rebol into their own cgi-bin

Graham - because then user can't do it, ISP has to  ...

Volker, often hosts will not allow exes outside cgi-bin

Usually you can put it in homedir or such.

so, even if you put outside the webfolders, you can't then execute 
it

Volker: but usually you don't get console access, only ftp to copy 
your web to ...

Hmm, that is bad. thought exes outside would be ok. talk to host?

I did that for micha and it worked. thought that is common.

advantage of having rebol in cgi-bin is, that you can update it yourself, 
not asking your ISP to update it for you each time new version is 
out :-)

can you have subdirs with cgi-scripts? so that you can call http://cgi-bin/project1/script.cgi
?

then maybe you can restrict access to that folder by .htaccess.

well, as for my server, I can install rebol regullarly. We just were 
thinking loud here with Graham, if that is good aproach or not to 
have it in cgi-bin, so simply you could run your rebol scripts without 
ISP to even know you are using rebol :-)

Grahams obfuscation-trick should work too, as long as nobody on the 
same server tries to break in.