Ftp Server 1.32 – Credential Disclosure - 体验盒子

作者： ManhNho

日期： 2018-06-07

类别：

local

平台：

android

来源：https://www.exploit-db.com/exploits/44852/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

# Exploit Title: Ftp Server 1.32 - Credential Disclosure

# Date: 2018-05-29

# Software Link: https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver

# Version: 1.32 Android App

# Vendor: The Olive Tree

# Exploit Author: ManhNho

# CVE: N/A

# Category: Mobile Apps

# Tested on: Android 4.4

# Description

# Ftp Server 1.32 Insecure Data Storage, the result of storing confidential

# information insecurely on the system i.e. poor encryption, plain text,

# access control issues etc. Attacker can find out username/password of valid user via

# /data/data/com.theolivetree.ftpserver/shared_prefs/com.theolivetree.ftpserver_preferences.xml

# PoC

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>

<map>

<string name="prefUserpass">ManhNho</string>

<string name="prefUsername">ManhNho</string>

</map>