gitcollect/cve-2016-4971Node.js proof-of-concept exploit for CVE-2016-4971, demonstrating wget FTP redirect filename trust vulnerability with a simple HTTP server.
On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename.
See the post on my blog for some detail.
On your server,
node wget.js
On your test computer,
wget http://url.to.your/server
screenshot 1
screenshot 2
