CVE-2019-16278 PoC — nostromo nhttpd 路径遍历漏洞

Source

https://github.com/keshiba/cve-2019-16278

Associated Vulnerability

Title:nostromo nhttpd 路径遍历漏洞 (CVE-2019-16278)
Description:Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

Description

Exploit for the CVE-2019-16278 vulnerability

Readme

# CVE-2019-16278

![Rust](https://github.com/keshiba/cve-2019-16278/workflows/Rust/badge.svg)

This is an exploit for the CVE-2019-16278 vulnerability.

It allows remote code execution on an **nhttpd** server *v1.9.6*.

## Building from Source
This tool is written in Rust and you need to install the Rust compiler which is super easy if you follow the instructions in their [page](https://www.rust-lang.org/tools/install)

### Compiling
Once you have the compiler and `cargo` installed, you can run:
```bash
cargo build
```

## Example
```bash
./cve-2019-16278 10.10.1.1 80 "cat /etc/passwd"
```
This example connects to the host 10.10.1.1 on port 80 and executes the `cat /etc/passwd` on the remote host.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!