Skip to content

Commit 7763be9

Browse files
Chocapikkjvoisin
andauthored
Update documentation/modules/auxiliary/gather/gladinet_storage_access_ticket_forge.md
Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>
1 parent a35a953 commit 7763be9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

documentation/modules/auxiliary/gather/gladinet_storage_access_ticket_forge.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ The access ticket is an encrypted string that contains:
88
- Filepath: The absolute path to the file on the server
99
- Username: Empty (Application Pool Identity will be used)
1010
- Password: Empty
11-
- Timestamp: Creation time (set to excessive year to never expire)
11+
- Timestamp: Creation time (set to 100 years in the future so that it doesn't expire)
1212

1313
Because the cryptographic keys are hardcoded and identical across all vulnerable installations, an attacker can forge
1414
tickets to read arbitrary files from the server's file system, including sensitive configuration files like `Web.config`

0 commit comments

Comments
 (0)