File tree Expand file tree Collapse file tree 2 files changed +31
-4
lines changed
documentation/modules/auxiliary/scanner/ftp
modules/auxiliary/scanner/ftp Expand file tree Collapse file tree 2 files changed +31
-4
lines changed Original file line number Diff line number Diff line change
1
+ This module exploits a directory traversal vulnerability in Easy File Sharing FTP Server 3.6, or
2
+ prior. It abuses the RETR command in FTP in order to retrieve a file outside the shared directory.
3
+
4
+ By default, anonymous access is allowed by the FTP server.
5
+
6
+ ## Vulnerable Application
7
+
8
+ Easy File Sharing FTP Server version 3.6 or prior should be affected. You can download the
9
+ vulnerable application from the official website:
10
+
11
+ http://www.efssoft.com/efsfs.exe
12
+
13
+ ## Options
14
+
15
+ Since the FTP server allows anonymous access, by default, you only need to configure:
16
+
17
+ ** RHOSTS**
18
+
19
+ The FTP server IP address.
20
+
21
+ ** PATH**
22
+
23
+ The file you wish to download. Assume this path starts from C:\
24
+
25
+ ## Demonstration
26
+
27
+ ![ ftp] ( https://cloud.githubusercontent.com/assets/1170914/23971054/4fdc2b08-099a-11e7-88ea-67a678628e49.gif )
Original file line number Diff line number Diff line change @@ -13,7 +13,7 @@ class MetasploitModule < Msf::Auxiliary
13
13
14
14
def initialize ( info = { } )
15
15
super ( update_info ( info ,
16
- 'Name' => 'Easy File Sharing FTP Server Version 3.6 and Earlier Directory Traversal Information Disclosure ' ,
16
+ 'Name' => 'Easy File Sharing FTP Server 3.6 Directory Traversal' ,
17
17
'Description' => %q{
18
18
This module exploits a directory traversal vulnerability found in Easy File Sharing FTP Server Version 3.6 and Earlier.
19
19
This vulnerability allows an attacker to download arbitrary files from the server by crafting
@@ -43,7 +43,7 @@ def check_host(ip)
43
43
begin
44
44
connect
45
45
if /Easy File Sharing FTP Server/i === banner
46
- return Exploit ::CheckCode ::Appears
46
+ return Exploit ::CheckCode ::Detected
47
47
end
48
48
ensure
49
49
disconnect
@@ -58,7 +58,7 @@ def run_host(target_host)
58
58
connect_login
59
59
sock = data_connect
60
60
if sock . nil?
61
- error_msg = __FILE__ <<'::' << __method__ . to_s << ':' << 'data_connect failed; posssible invalid response'
61
+ error_msg = 'data_connect failed; posssible invalid response'
62
62
print_status ( error_msg )
63
63
elog ( error_msg )
64
64
else
@@ -72,7 +72,7 @@ def run_host(target_host)
72
72
# read the file data from the socket that we opened
73
73
# dont assume theres still a sock to read from. Per #7582
74
74
if sock . nil?
75
- error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
75
+ error_msg = 'data_connect failed; posssible invalid response'
76
76
print_status ( error_msg )
77
77
elog ( error_msg )
78
78
return
You can’t perform that action at this time.
0 commit comments