UoW pop2d Remote File Retrieval Vulnerability

This module exploits a vulnerability in the FOLD command of the University of Washington ipop2d service. By specifying an arbitrary folder name it is possible to retrieve any file which is world or group readable by the user ID of the POP account. This vulnerability can only be exploited with a valid username and password. The From address is the file owner.

Search Other Modules

Rank

Normal

Authors

patrick < patrick [at] osisecurity.com.au >

Vulnerability References

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/admin/pop2/uw_fileretrieval
msf auxiliary(uw_fileretrieval) > set RHOST [TARGET IP]
msf auxiliary(uw_fileretrieval) > run

Module Options

FILE	The file to retrieve (default: /etc/passwd)
POP2PASS	The password for the specified username
POP2USER	The username to authenticate as
RHOST	The target address
RPORT	The target port (default: 109)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
Proxies	Use a proxy chain
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)