nobody.cgi is a simple Perl script that you can use to execute commands as user:nobody. Do you have a message board, counter or any other script on your server that generates files? Have you ever tried to manually edit one of these files? You may have noticed that you can't because you don't own the file - user:nobody owns the file and you can't edit it!
By installing nobody.cgi on your server, you can execute commands with user:nobody's permissions, which means you can create, delete, view, modify and change permissions on files owned by user:nobody.
WARNING!!! This script could be a potential security hazard. The script should not be made accessible to the public and should be disabled when not in use (the script provides means for disabling itself).
To install the script, unzip the file nobody.cgi and transfer it to your cgi-bin. Be sure to use ASCII mode when transferring the file.
You will need to edit the top line of the script to point to perl on your server. type "which perl" (without the quotes) at the telnet prompt to find the location of perl on your server or contact your network administrator.
Make sure the file permission on nobody.cgi is set so that web visitors can execute it. "chmod 705 nobody.cgi" (without the quotes) at the telnet prompt should do the trick, or you can use the file permission features on your FTP software.
Unless you rename the script, you should only need to edit one configuration variable: disable. Set this to 0 when you are using the script, and then set it to 1 when you are not. This prevents people from stumbling upon the script and using it. It is recommended that you place the script in a protected directory as well. For that, you are on your own, but try searching .htaccess for more information.
To use nobody.cgi, simple open the script using your favorite forms-capable web browser. (The URL should be something like http://www.yourdomain.com/cgi-bin/nobody.cgi) You should see a black screen with a large text box and a single line text box. Enter a UNIX command in the small text box and hit enter or click the "Execute" button.
Here are a few useful commands to get you started:
ls -al (this will show you all the scripts in your cgi-bin) cat nobody.cgi (this will print out the code of nobody.cgi) chmod 777 *.* (you get the picture... read a UNIX book for more info)
WARNING!!! This script could be used to modify or erase your own files or anyone else's files on your server. Be careful when using this script. Also, be considerate - don't use this script to erase or modify other people's files. It's not nice. Changes you make to files using this script will be logged just like everything else, so don't think you can get away with it!
nobody.cgi Version History:
© 1998, VerySimple.