Anvilpoint CyberOps - Hacker for Hire ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › Joomla website hack

New Reply 

Joomla website hack
RiaanN
RiaanN Offline
[n00b@HF:]
*
Registered
Posts:
22
Threads:
9
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 15, 2019 08:10 AM
Good Day

Normally when you do a scan, one is quite happy seeing 1 or 2 vulnerabilities. So when I saw the following I was quite excited. However it did not last very long because I am still not able to get into the site.

I will give the URL to people who are interested in helping me, and in the process maybe give me a couple of pointers.

The following vulnerabilities were detected

[+] Detecting Joomla Version
[++] Joomla 1.5

[+] Core Joomla Vulnerability
[++] Joomla! 1.5 Beta 2 - 'Search' Remote Code Execution
EDB : 4212/

Joomla! 1.5 Beta1/Beta2/RC1 - SQL Injection
CVE : CVE-2007-4781
EDB : 4350/

Joomla! 1.5.x - (Token) Remote Admin Change Password
CVE : CVE-2008-3681
EDB : 6234/

Joomla! 1.5.x - Cross-Site Scripting / Information Disclosure
CVE: CVE-2011-4909
EDB : 33061/

Joomla! 1.5.x - 404 Error Page Cross-Site Scripting
EDB : 33378/

Joomla! 1.5.12 - read/exec Remote files
EDB : 11263/

Joomla! 1.5.12 - connect back Exploit
EDB : 11262/

Joomla! Plugin 'tinybrowser' 1.5.12 - Arbitrary File Upload / Code Execution (Metasploit)
CVE : CVE-2011-4908
EDB : 9926/

Joomla! 1.5 - URL Redirecting
EDB : 14722/

Joomla! 1.5.x - SQL Error Information Disclosure
EDB : 34955/

Joomla! - Spam Mail Relay
EDB : 15979/

Joomla! 1.5/1.6 - JFilterInput Cross-Site Scripting Bypass
EDB : 16091/

Joomla! < 1.7.0 - Multiple Cross-Site Scripting Vulnerabilities
EDB : 36176/

Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution
CVE : CVE-2015-8562
EDB : 38977/

Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution
CVE : CVE-2015-8562 , CVE-2015-8566
EDB : 39033/

Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion
CVE : CVE-2007-2199
EDB : 3781/

Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal
CVE : CVE-2009-0113
EDB : 7691/
Abruptum
Abruptum Offline
[bin@HF:]
*
Registered
Posts:
685
Threads:
6
Credibility:
000
Popularity:
47
βytes:
β 0
Game XP:
0
Jan 15, 2019 11:48 AM
(Jan 15, 2019 08:10 AM)RiaanN Wrote:  Good Day

Normally when you do a scan, one is quite happy seeing 1 or 2 vulnerabilities. So when I saw the following I was quite excited. However it did not last very long because I am still not able to get into the site.

I will give the URL to people who are interested in helping me, and in the process maybe give me a couple of pointers.

The following vulnerabilities were detected

[+] Detecting Joomla Version
[++] Joomla 1.5

[+] Core Joomla Vulnerability
[++] Joomla! 1.5 Beta 2 - 'Search' Remote Code Execution
EDB : 4212/

Joomla! 1.5 Beta1/Beta2/RC1 - SQL Injection
CVE : CVE-2007-4781
EDB : 4350/

Joomla! 1.5.x - (Token) Remote Admin Change Password
CVE : CVE-2008-3681
EDB : 6234/

Joomla! 1.5.x - Cross-Site Scripting / Information Disclosure
CVE: CVE-2011-4909
EDB : 33061/

Joomla! 1.5.x - 404 Error Page Cross-Site Scripting
EDB : 33378/

Joomla! 1.5.12 - read/exec Remote files
EDB : 11263/

Joomla! 1.5.12 - connect back Exploit
EDB : 11262/

Joomla! Plugin 'tinybrowser' 1.5.12 - Arbitrary File Upload / Code Execution (Metasploit)
CVE : CVE-2011-4908
EDB : 9926/

Joomla! 1.5 - URL Redirecting
EDB : 14722/

Joomla! 1.5.x - SQL Error Information Disclosure
EDB : 34955/

Joomla! - Spam Mail Relay
EDB : 15979/

Joomla! 1.5/1.6 - JFilterInput Cross-Site Scripting Bypass
EDB : 16091/

Joomla! < 1.7.0 - Multiple Cross-Site Scripting Vulnerabilities
EDB : 36176/

Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution
CVE : CVE-2015-8562
EDB : 38977/

Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution
CVE : CVE-2015-8562 , CVE-2015-8566
EDB : 39033/

Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion
CVE : CVE-2007-2199
EDB : 3781/

Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal
CVE : CVE-2009-0113
EDB : 7691/

An incredible old website or an honeypot, i am sure this one is hacked allready if this is not an honeypot :D
RiaanN
RiaanN Offline
[n00b@HF:]
*
Registered
Posts:
22
Threads:
9
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 16, 2019 06:55 AM (This post was last modified: Jan 16, 2019 06:58 AM by RiaanN.)
(Jan 15, 2019 11:48 AM)Abruptum Wrote:  An incredible old website or an honeypot, i am sure this one is hacked allready if this is not an honeypot :D

Old maybe, but not a honeypot that is for sure. The only reason I am having a hard time getting access is because of ModSecurity
NoTspecified
NoTspecified Offline
[n00b@HF:]
*
Registered
Posts:
1
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 17, 2019 03:10 PM
Try encoding your payloads in Hex,unicode,base64 or similar. I don't know if it will work with OS commands(I believe it should passed thru the webapp) but I have done this with SQL to defeat WAFs however newer versions of mod_sec have gotten a lot better at catching these rule bypasses with their reward program. But I agree with above post it's intentionally vulnerable or been hacked already,but I've been wrong before. Stay safe
RiaanN
RiaanN Offline
[n00b@HF:]
*
Registered
Posts:
22
Threads:
9
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 18, 2019 03:17 AM
This is a site in South Africa - co.za domain

I know it is old, because I know the people who own the business. It is a site where you can book a SPA session, nothing fancy. And it was not hacked before.



(Jan 17, 2019 03:10 PM)NoTspecified Wrote:  Try encoding your payloads in Hex,unicode,base64 or similar. I don't know if it will work with OS commands(I believe it should passed thru the webapp) but I have done this with SQL to defeat WAFs however newer versions of mod_sec have gotten a lot better at catching these rule bypasses with their reward program. But I agree with above post it's intentionally vulnerable or been hacked already,but I've been wrong before. Stay safe
mircel
mircel Offline
[n00b@HF:]
*
Registered
Posts:
25
Threads:
0
Credibility:
000
Popularity:
1
βytes:
β 0
Game XP:
0
Jan 25, 2019 06:51 AM
find the joomla version and check for exploits for that version
RiaanN
RiaanN Offline
[n00b@HF:]
*
Registered
Posts:
22
Threads:
9
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 25, 2019 10:05 AM
(Jan 25, 2019 06:51 AM)mircel Wrote:  find the joomla version and check for exploits for that version


Nah - Done that with the first scan. It is an old version, but with every attack (guided by the vulnerability database) I came off second best. I know the site is protected by MOD security, because I get a message about that the moment I try to do SQL injection.

My problem now is that I start to lose faith in some of the vulnerability scanners out there.
Boolie
Boolie Offline
[n00b@HF:]
*
Registered
Posts:
5
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 25, 2019 10:41 AM
Here are some pointers.
0xF2D0C6E2
0x23C5F013
0x563FFBC0

I hope you like them.
Please gib rep ++
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by siska2828Jun 23, 2019 09:15 AM 5 207 Jun 23, 2019 09:15 AM
Last Post: Elweth
by siska2828Jun 21, 2019 02:11 AM 4 182 Jun 21, 2019 02:11 AM
Last Post: siska2828
by dragon3rzDec 21, 2017 02:51 AM 2 236 Dec 21, 2017 02:51 AM
Last Post: parnaozi