Skip to content

Commit ff30a27

Browse files
committed
Windows paths need 2 backslashes
1 parent 223bc34 commit ff30a27

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

modules/auxiliary/admin/http/netflow_file_download.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ def initialize(info={})
1616
'Description' => %q{
1717
This module exploits an arbitrary file download vulnerability in CSVServlet
1818
on ManageEngine NetFlow Analyzer. This module has been tested on both Windows
19-
and Linux with versions 8.6 to 10.2. Windows paths have to be escaped with 4
19+
and Linux with versions 8.6 to 10.2. Windows paths have to be escaped with 2
2020
backslashes on the command line.
2121
},
2222
'Author' =>
@@ -38,7 +38,7 @@ def initialize(info={})
3838
Opt::RPORT(8080),
3939
OptString.new('TARGETURI',
4040
[ true, "The base path to NetFlow Analyzer", '/netflow' ]),
41-
OptString.new('FILEPATH', [true, 'Path of the file to download (escape Windows paths with 4 back slashes)', '/etc/passwd']),
41+
OptString.new('FILEPATH', [true, 'Path of the file to download (escape Windows paths with 2 back slashes)', '/etc/passwd']),
4242
], self.class)
4343
end
4444

0 commit comments

Comments
 (0)