FetchFile Servlet - Path Traversal Detection (CVE-2016-6601)

Detects CVE-2016-6601 by reading /etc/passwd or conf/securitydbData.xml via /servlets/FetchFile?fileName=. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vendors /servlets/FetchFile path traversal CVE-2016-6601.""" import re from kittysploit import from lib.protocols.http.httpclient import...

WebNMS Framework Server Credential Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebNMS Framework Server Credential Disclosure', 'Description' = %q This module abuses two vulnerabilities in WebNMS Framework Server 5.2 to extra...

WebNMS Framework Server Arbitrary Text File Download

This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an unauthenticated user to download files off the file system by using a directory traversal attack on the FetchFile servlet. Note that only text files can be downloaded properly, as any binary file will get mangled by...