Arbitrary File Retrieval in TYPO3 CMS via Forged HMAC

This repository is a small, focused exploit project for TYPO3 CVE-2020-15099. It contains two files: a README with exploitation guidance and one Python entry-point script, typo3_exploit.py. The script is a real exploit, not a scanner or detection utility. The exploit targets unsafe deserialization in TYPO3 Form Framework frontend handling of the __state parameter. Its core capability is to forge a valid HMAC-signed serialized payload using a known TYPO3 encryptionKey, submit that payload to an unauthenticated frontend form, trigger a phpggc Guzzle/FW1 gadget chain, and write a PHP webshell to an attacker-chosen path under the web root. After delivery, it waits, verifies shell availability over HTTP, and can open an interactive command shell by sending commands through the shell's cmd GET parameter. Repository structure is simple: README.md documents prerequisites, vulnerable versions, required parameters, and operational workflow; typo3_exploit.py implements the attack flow. From the visible code and README, the script performs these stages: parse CLI arguments; normalize the target URL; create a local PHP shell file; fetch the target form page to obtain a fresh cHash and extract __trustedProperties; generate a serialized gadget payload using phpggc with PHP 7.2 compatibility (Docker by default, local PHP optional); sign the payload with HMAC-SHA1 using the leaked encryptionKey; POST the payload in the TYPO3 form field tx_form_formframework[<form>][__state]; wait for the gadget destructor to write the shell; verify the shell URL; and optionally provide an interactive shell session. The exploit is network-based and operationally mature enough to automate end-to-end exploitation, but it uses a basic hardcoded payload (a simple PHP webshell), so OPERATIONAL is the best fit rather than WEAPONIZED. Fingerprintable targets and artifacts include TYPO3 configuration file paths used to obtain the encryptionKey, common writable TYPO3 directories for shell placement, the shell URL, the form page URL pattern, and the specific TYPO3 form parameter name used for exploitation.