TUCoPS :: Crypto :: cesar~1.htm

CesarFTP v0.98b Directory Traversal, Weak Password Encryption



    CesarFTP v0.98b


    'ByteRage' found following.

    1) Directory Traversal
    First, we need a directory where  we have access to on the  victim
    host...  (Or we can create one if we have enough rights)

    might give us a directory RESTRICTED/ for example now we do:

    and we're out of the restricted subdirectory, we have read  access
    to the whole harddrive

    2) Weak password encryption
    Once again  an FTP  server with  weak password  encryption...  The
    username:password pairs  are stored  in plaintext  in the  program
    directory (\program  files\CesarFTP\settings.ini).   Combined with
    the directory traversal, the password file can be easily  attained
    by any user...


    Nothing yet.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH