You are viewing a single comment's thread.

view the rest of the comments →

16337615? ago

I'm not l337 enough to hack this :(

16350044? ago

The security of that website is laughable. Each file can be easily downloaded:

http://www.teris.ch/download.asp?ogg=&name={filename}

Where {filename} is relative to e:/virtual/www.teris.ch/db/files/

If you want to take a look at page.asp, you just request:

http://www.teris.ch/download.asp?ogg=&name=../../www/page.asp

I haven't been able to find any exploits to enter the admin backend. I can only confirm that the username is definitely admin.

16351268? ago

The web server is Microsoft IIS 6.0. Do you think we could use CVE-2017-7269 to attack it? There's also an FTP server at port 21, but I don't know the password.