Executive brief
Evil-WinRM is a popular tool used by security professionals to remotely manage Windows systems. A vulnerability in its directory download feature allows a malicious or compromised Windows server to trick the user's computer into overwriting its own sensitive files. This could allow an attacker to gain permanent access to the user's machine or escalate their privileges by replacing critical configuration files like SSH keys.
Technical details
A path traversal vulnerability exists in the `download_dir()` function of Evil-WinRM through version 3.9. The root cause is the lack of sanitization of filenames returned by the `Get-ChildItem` command on the remote Windows server before they are passed to `File.join()` on the client side. A compromised or rogue server can return filenames containing traversal sequences (e.g., `../../.ssh/authorized_keys`). Because Ruby's `File.join` does not automatically strip these sequences, the client will write the downloaded file to an arbitrary location on the local filesystem. This can result in the overwriting of sensitive files such as SSH authorized_keys or shell profiles. The issue was fixed in commit 6ecd570 by applying `File.basename()` to server-supplied filenames.
Affected products
- Hackplayers Evil-WinRM through 3.9
Timeline
- 2026-05-26: disclosed: Vulnerability reported via GitHub Pull Request #81
- 2026-06-01: patched: Fix merged into development branch via commit 6ecd570
- 2026-06-17: advisory: CVE-2026-55201 published