Hero broadband WEB site arbitrary 0-day Download Vulnerability and repair

The URL popped up when you download the player, http: // 10.0.2.100/web/html/download. asp? File = ../herotemp/jtplayer.exe

Let's take a look at the source code of download. asp.

<%
Dim path
Path = Request. QueryString ("file ")
If path <> "" Then
On Error Resume Next
Path = Server. MapPath (path)
Downloadfile (path)
End If
Function downloadfile (fullpath)
Downloadfile = false
Dim strfilename, s, fso, f, intfilelength
Set fso = server. createobject ("scripting. filesystemobject ")
If not fso. fileexists (fullpath) Then
Response. write "sorry, this file does not exist"
Response. end
Exit function
End if
Set f = fso. getfile (fullpath)
Get File Size
Intfilelength = f. size
Set s = server. createobject ("adodb. stream ")
S. open
S. type = 1
S. loadfromfile (fullpath)
Response. buffer = true
Response. clear
Response. addheader "content-type", "application/x-msdownload"
Response. addheader "content-disposition", "attachment; filename =" & f. name
Response. addheader "content-length", intfilelength
Response. contenttype = "application/octet-stream"
While not s. eos
Response. binarywrite s. read (1024*64)
Response. flush
Wend
S. close
Set s = nothing
Downloadfile = true
End function
%>

Direct

Path = Server. MapPath (path)
Downloadfile (path)

When the file value is assigned, FSO is directly called.

 

Okay. Go to the homepage and check the configuration file. <! -- # Include file = "../inc/MyConfig. asp" -->

Then download WebFolderUrl = root_SiteUrl & "web/" to read the directory where the configuration file (config. xml) is read.

Directly found the configuration file,

There are SQL statements and ACCESS paths. Needless to say, you can also directly download the readable DLL in SYSTEM32 ..

You can guess the path of the configuration file such as SERV-U and IIS ~ Haha

Internet cafes use a lot of this program. We hope the official website will fix it as soon as possible.