The script http-tplink-dir-traversal.nse performs the following tasks to exploit the discussed path traversal vulnerability:
- First, it sends a path traversal request to determine if an installation is vulnerable.
- If the installation is vulnerable, extract the requested file out of the response sent by the web server.
- Report the vulnerability to the user and provide the proof of concept.
In this case, the library http was required to send the HTTP request containing the path traversal payload. To determine if the device is vulnerable, we request the file /etc/shadow because we know this file exists in all of the devices, and a root account must exist in it:
local response = http.get(host, port, "/help/../../../etc/shadow") ...
