Fixes a bug that prevented the script to find its resource file. Fixes #1608

CHANGELOG

@@ -1,5 +1,8 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE][GH#1608] Script http-fileupload-exploiter failed to locate its resource
+  file unless executed from a specific working directory. [nnposter]
+
 o [NSE][GH#1571] The HTTP library now provides transparent support for gzip-
   encoded response body. (See https://github.com/nmap/nmap/pull/1571 for an
   overview.) [nnposter]

scripts/http-fileupload-exploiter.nse

@@ -56,6 +56,7 @@ license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
 
 local http = require "http"
 local io = require "io"
+local nmap = require "nmap"
 local string = require "string"
 local httpspider = require "httpspider"
 local shortport = require "shortport"
@@ -211,6 +212,16 @@ action = function(host, port)
   local foundfield = 0
   local fail = 0
 
+  local pixel = nil
+  local pixelfn = nmap.fetchfile("nselib/data/pixel.gif")
+  if pixelfn then
+    local fh = io.open(pixelfn, "rb")
+    pixel = fh:read("a")
+    fh:close()
+  end
+  if not pixel then
+    stdnse.debug1("Warning: Test file nselib/data/pixel.gif not found")
+  end
 
   local crawler = httpspider.Crawler:new( host, port, '/', { scriptname = SCRIPT_NAME } )
 
@@ -300,10 +311,8 @@ action = function(host, port)
             end
 
             -- Method (3).
-            local inp = assert(io.open("nselib/data/pixel.gif", "rb"))
-            local image = inp:read("a")
-
-            buildRequests(host, port, submission, filefield["name"], "image/gif", partofrequest, uploadspaths, image)
+            if pixel then
+              buildRequests(host, port, submission, filefield["name"], "image/gif", partofrequest, uploadspaths, pixel)
 
               result = makeAndCheckRequests(uploadspaths)
               if result then
@@ -312,6 +321,7 @@ action = function(host, port)
                 fail = 1
               end
             end
+          end
         else
           table.insert(returntable, {"Couldn't find a file-type field."})
         end