CVE-2007-4174
Tor < 0.1.2.16 - Unauthenticated Configuration Modification via ControlPort
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-4174. PoCs published by elgCrew, anonymous.
AI-analyzed exploit summary This exploit targets Tor versions before 0.1.2.16 with ControlPort enabled. It rewrites the torrc configuration file to log debug output to a startup script (t.bat) and injects a malicious ExitPolicy command to execute arbitrary commands (e.g., calc.exe) on the next system boot.
Description
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.
Exploits (2)
This exploit targets Tor versions before 0.1.2.16 with ControlPort enabled. It rewrites the torrc configuration file to log debug output to a startup script (t.bat) and injects a malicious ExitPolicy command to execute arbitrary commands (e.g., calc.exe) on the next system boot.
This exploit targets Tor's ControlPort vulnerability (CVE-2007-4174) by injecting malicious commands via JavaScript to rewrite the torrc configuration file. It enables debug logging to a startup script (t.bat) and injects a command to execute calc.exe on the next system boot.