CVE-2000-0248
published 2000-04-24CVE-2000-0248: The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute…
PriorityP271critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
73.66%
99.4th percentile
The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://victim.example.com/piranha/secure/passwd.php3?try1=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&try2=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&passwd=ACCEPT↗
- →Detect HTTP GET requests targeting /piranha/secure/passwd.php3 with query parameters 'try1', 'try2', and 'passwd=ACCEPT', which is the exploitation pattern for metacharacter injection. ↗
- →Alert on HTTP Basic Authentication attempts using the credential pair piranha:q against the /piranha/ web path, as this is the known default backdoor credential exploited in the wild. ↗
- →Look for semicolon metacharacter injection (URL-encoded as %3B) within the try1 and try2 query parameters of requests to passwd.php3, indicating command injection attempts. ↗
- →Monitor for server responses containing the string 'The passwords you supplied match' from /piranha/secure/passwd.php3, which the Metasploit module uses to confirm successful command execution. ↗
- ·The exploit requires HTTP Basic Authentication; the default credentials (piranha:q) must be accepted by the target. A 401 response indicates the default credentials have been changed and the exploit will not proceed. ↗
- ·PHP's magic_quotes_gpc is on by default on affected RedHat 6.2 systems, causing escaping of single/double quotes in injected commands. The Metasploit module uses a PrintfPHPMagicQuotes encoder and excludes quote characters (0x22, 0x27) from payloads to work around this. ↗
- ·Commands execute as the Apache user account (nobody), not as root, limiting post-exploitation privilege without a local privilege escalation. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9rr2-45q8-fjmg: The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to e
ghsa_unreviewed·2022-04-30
CVE-2000-0248 [HIGH] GHSA-9rr2-45q8-fjmg: The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to e
The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.
VulnCheck
Red Hat Linux Piranha Package Linux Virtual Server (LVS) Vulnerability
vulncheck·2000·CVSS 10.0
CVE-2000-0248 [CRITICAL] Red Hat Linux Piranha Package Linux Virtual Server (LVS) Vulnerability
Red Hat Linux Piranha Package Linux Virtual Server (LVS) Vulnerability
The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.
Affected: Red Hat linux
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://packetstormsecurity.com/files/86303/RedHat-Piranha-Virtual-Server-Package-passwd.php3-Arbitrary-Command-Execution.html
Red Hat
security flaw
vendor_redhat·2000-04-24·CVSS 10.0
CVE-2000-0248 [CRITICAL] security flaw
security flaw
The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.
No detection rules found.
Exploit-DB
RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
exploitdb·2010-10-18
CVE-2000-0322 RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
---
##
# $Id: piranha_passwd_exec.rb 10729 2010-10-18 15:41:13Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 [ /Apache/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution',
'Description' => %q{
This module abuses two flaws - a metacharacter injection vulnerability in the
HTTP management server of RedHat
Exploit-DB
RedHat 6.2 Piranha Virtual Server Package - Default Account and Password
exploitdb·2000-04-24
CVE-2000-0248 RedHat 6.2 Piranha Virtual Server Package - Default Account and Password
RedHat 6.2 Piranha Virtual Server Package - Default Account and Password
---
source: https://www.securityfocus.com/bid/1148/info
A default username and password has been discovered in the Piranha virtual server and load balancing package from RedHat. Version 0.4.12 of the piranha-gui program contains a default account, piranha, with the password 'q' (no quotes). Using this username and password, in conjunction with flaws in the passwd.php3 script (also part of piranha) will allow remote users to execute arbitrary commands on the machine.
The default username and password are piranha, and q, respectively.
Execute the following url, using the above information to authenticate: http://victim.example.com/piranha/secure/passwd.php3
Next, execute the following: http://victim.example.com/pi
Metasploit
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
metasploit
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
This module abuses two flaws - a metacharacter injection vulnerability in the HTTP management server of RedHat 6.2 systems running the Piranha LVS cluster service and GUI (rpm packages: piranha and piranha-gui). The vulnerability allows an authenticated attacker to execute arbitrary commands as the Apache user account (nobody) within the /piranha/secure/passwd.php3 script. The package installs with a default user and password of piranha:q which was exploited in the wild.
2000-04-24
Published
Exploited in the wild