lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 24 Dec 2015 16:59:17 -0800
From: Rio Sherri <rio.sherri@...nstudent.info>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] EasyCafe Server <= 2.2.14 Remote File Read

# Title : EasyCafe Server <= 2.2.14 Remote File Read
# Date : 25/12/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Software Link : http://www.tinasoft.com/easycafe/
# Vulnerable Versions : EasyCafe Server <= 2.2.14
# EasyCafe Server has a feature to upload file from the server to a client.
# And the request is as following. EasyCafe Server sends an UDP request to
the client with the file that wants to upload,
# Then the client receives the packet and connects to the server on port
831 and sends the directory of the file and receives it.
# The problem is that a remote attacker can connect to port 831 and can
retrive a file because the server doesn't validate the request,
# and does not check if it has sent the UDP request which gives us full
Read access to the system.

POC is attached.

View attachment "tinasoft.py" of type "text/plain" (1943 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists