####################################################################### Luigi Auriemma Application: Novell File Reporter http://www.novell.com/products/file-reporter/ Versions: <= 1.0.4.2 Platforms: Windows, Linux, NetWare Bug: arbitrary files deletion Exploitation: remote, versus server Date: 27 Jun 2011 (found 18 Apr 2011) Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Novell File Reporter is a software that creates reports on the state and activity of files and storages. ####################################################################### ====== 2) Bug ====== NFRAgent.exe is a SYSTEM service listening on the default HTTPS port 3037. Through the NAME SRS, OPERATION 4 and CMD 5 is possible to delete any arbitrary file on the remote system and shares with SYSTEM privileges since the service calls directly DeleteFileA with the string provided in our PATH value. The sequence of chars before the RECORD data is the md5 hash calculated on a string composed by such data placed between the strings "SRS" and "SERVER". ####################################################################### =========== 3) The Code =========== http://aluigi.org/mytoolz/stcppipe.zip http://aluigi.org/poc/nfr_2.dat stcppipe -Y 2 SERVER 3037 1234 nc 127.0.0.1 1234 < nfr_2.dat the deleted file will be c:\windows\myfile.txt ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### --- Luigi Auriemma http://aluigi.org