- #Wing ftp server exploit how to
- #Wing ftp server exploit software
- #Wing ftp server exploit password
- #Wing ftp server exploit download
In the remote management panel there is a console written in the LUA language, which can be exploited to execute commands in the Operating System through the os.execute() function native to lua.īelow is a remote command execution PoC through the lua console to obtain a reverse shell on the target machine.
#Wing ftp server exploit password
The C:\Program Files (x86)Wing FTP Server_ADMINISTRATOR\admins.xml file stores the admin credentials by saving the password in an md5 hash, which can be easily deciphered, as shown in the image below: When accessing the Wing FTP Server remote management panel, the credentials are transmitted in clear, as shown in the image below:Īnother vulnerability found is the unprotected storage of the application's admin credentials. You can also monitor server performance and online sessions and even receive email notifications about various events taking place on the server.
And it provides admins with a web-based interface to administrate the server from anywhere. It supports multiple file transfer protocols, including FTP, FTPS, HTTP, HTTPS, and SFTP, giving your clients flexibility in how they connect to the server.
#Wing ftp server exploit software
Wing FTP Server is an easy-to-use, powerful, and free FTP server software for Windows, Linux, Mac OS, and Solaris. Multiple vulnerability was founded on Wing FTP Server 6.3.8:
#Wing ftp server exploit how to
This PoC explain how to exploit Wing FTP Server 6.3.8 to get Remote Code Execution Your custom rule sids should be 1000000 or above, anything below this is reserved for the snort distribution rules.Wing FTP Server 6.3.8 - Remote Code Execution Having this in the rule will no prevent the rule from triggering if you aren't using target based, so it's also a good practice to put this in if you know the service this traffic is. If you are using target based (which now a days you should be), you need to add the service http keyword. This is going to be in the client body, so add the http_client_body option. Since this is the only content match in the rule that is case sensitive snort would put this into the fast pattern matcher on it's own, but if you modify the rule later on with another content match you would want this to be the content match to use for the fast_pattern matcher.Ĭontent:"command=os.execute" http_client_body nocase You know this content is static and never changing (case included) so this is eligible for the fast pattern matcher. You want nocase for the post match because it is not required by http for the method to be all capital letters.Ĭontent:"/admin_lua_script.html" fast_pattern http_uri Īdding the fast_pattern option will make the rule more efficient as it will put it into the fast pattern matcher in snort. The only way the request would be successful would be if the connection was already established between client and server, if it's not the exploit won't succeed and it's pointless to alert on this. This will be more efficient as snort won't have to check random traffic for unestablished sessions and it won't have to check traffic going to the client, since you know the direction for this exploit will always be going to the server. You only want to check established sessions where the flow is going to the server. PHP applica- tions, of course, require a web server that is PHP enabled.
#Wing ftp server exploit download
tags exploit, remote, code execution SHA-256 998c2be0b0522190dcae0ebfec889301aac9b989c5003477f006c606eb368b95 Download Favorite View Related Files Wing FTP Server 4.3.
If you do not have this port in your preprocessor config for http, all of your http content modifiers will NOT match because snort will not treat traffic on this port as http, which is likely the main issue you're having. databases, so ' databasified ' web applications frequently exploit PHP. Wing FTP Server versions 4.3.8 and below suffer from an authenticated remote code execution vulnerability. (obviously don't put the dots, just representing other ports you should have in there). Preprocessor http_inspect_server: server default profile all ports Specifically, your nf should have a configuration line similar to the following: Important: Since this exploit module runs over port 5466 and is http you NEED to make sure that this port is in your http preprocessor configuration for ports. When you have rules that are "any/any" for source/destination snort treats them differently than rules with ports defined. You should always specify a port when possible. (msg:"FTP command execution" flow:to_server,established /Ĭontent:"/admin_lua_script.html" fast_pattern http_uri /Ĭontent:"command=os.execute" http_client_body nocase / I would recommend something like the following: alert tcp any any -> any 5466 /
0 kommentar(er)
