setrjuicy.blogg.se

FTP Site Admin Posts: 1979 Joined: Tue 6:09 am. In the remote management panel there is a console written in the LUA language, which can be exploited to execute commands in the Operating System through the os.execute() function native to lua.īelow is a remote command execution PoC through the lua console to obtain a reverse shell on the target machine. Wing FTP Server 6.2.5 - Privilege Escalation. Please post here if you have problems in using Wing FTP Server. The C:\Program Files (x86)Wing FTP Server_ADMINISTRATOR\admins.xml file stores the admin credentials by saving the password in an md5 hash, which can be easily deciphered, as shown in the image below: When accessing the Wing FTP Server remote management panel, the credentials are transmitted in clear, as shown in the image below:Īnother vulnerability found is the unprotected storage of the application's admin credentials. You can also monitor server performance and online sessions and even receive email notifications about various events taking place on the server. And it provides admins with a web-based interface to administrate the server from anywhere. You can also monitor server performance and online sessions and even.