JoomlaRegPrivExploit.py 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256
  1. # Created by Aidmar
  2. """
  3. Joomla Account Creation and Privilege Escalation
  4. This attack creates an arbitrary account with administrative privileges in Joomla versions 3.4.4 through 3.6.3.
  5. more info:
  6. https://www.rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc
  7. """
  8. import logging
  9. import math
  10. from operator import itemgetter
  11. import operator
  12. from random import randint, uniform
  13. from lea import Lea
  14. from Attack import BaseAttack
  15. from Attack.AttackParameters import Parameter as Param
  16. from Attack.AttackParameters import ParameterTypes
  17. logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
  18. # noinspection PyPep8
  19. from scapy.utils import RawPcapReader
  20. from scapy.layers.inet import IP, Ether, TCP, RandShort
  21. #from scapy.all import *
  22. class JoomlaRegPrivExploit(BaseAttack.BaseAttack):
  23. # Metasploit default packet rate
  24. maxDefaultPPS = 55
  25. minDefaultPPS = 5
  26. # HTTP port
  27. http_port = 80
  28. # Metasploit experiments show this range of ports
  29. minDefaultPort = 30000
  30. maxDefaultPort = 50000
  31. def __init__(self, statistics, pcap_file_path):
  32. """
  33. Creates a new instance of the Joomla Registeration Privileges Escalation Exploit.
  34. :param statistics: A reference to the statistics class.
  35. """
  36. # Initialize attack
  37. super(JoomlaRegPrivExploit, self).__init__(statistics, "JoomlaRegPrivesc Exploit", "Injects an JoomlaRegPrivesc exploit'",
  38. "Resource Exhaustion")
  39. # Define allowed parameters and their type
  40. self.supported_params = {
  41. Param.MAC_SOURCE: ParameterTypes.TYPE_MAC_ADDRESS,
  42. Param.IP_SOURCE: ParameterTypes.TYPE_IP_ADDRESS,
  43. Param.MAC_DESTINATION: ParameterTypes.TYPE_MAC_ADDRESS,
  44. Param.IP_DESTINATION: ParameterTypes.TYPE_IP_ADDRESS,
  45. Param.TARGET_HOST: ParameterTypes.TYPE_URI,
  46. Param.TARGET_URI: ParameterTypes.TYPE_URI,
  47. Param.INJECT_AT_TIMESTAMP: ParameterTypes.TYPE_FLOAT,
  48. Param.INJECT_AFTER_PACKET: ParameterTypes.TYPE_PACKET_POSITION,
  49. Param.PACKETS_PER_SECOND: ParameterTypes.TYPE_FLOAT
  50. }
  51. # PARAMETERS: initialize with default utilsvalues
  52. # (values are overwritten if user specifies them)
  53. most_used_ip_address = self.statistics.get_most_used_ip_address()
  54. if isinstance(most_used_ip_address, list):
  55. most_used_ip_address = most_used_ip_address[0]
  56. self.add_param_value(Param.IP_SOURCE, most_used_ip_address)
  57. self.add_param_value(Param.MAC_SOURCE, self.statistics.get_mac_address(most_used_ip_address))
  58. self.add_param_value(Param.TARGET_URI, '/')
  59. self.add_param_value(Param.TARGET_HOST, "www.hackme.com")
  60. self.add_param_value(Param.INJECT_AFTER_PACKET, randint(0, self.statistics.get_packet_count()))
  61. self.add_param_value(Param.PACKETS_PER_SECOND,self.maxDefaultPPS)
  62. # victim configuration
  63. # consider that the destination has port 80 opened
  64. random_ip_address = self.statistics.get_random_ip_address()
  65. self.add_param_value(Param.IP_DESTINATION, random_ip_address)
  66. destination_mac = self.statistics.get_mac_address(random_ip_address)
  67. if isinstance(destination_mac, list) and len(destination_mac) == 0:
  68. destination_mac = self.generate_random_mac_address()
  69. self.add_param_value(Param.MAC_DESTINATION, destination_mac)
  70. def generate_attack_pcap(self):
  71. def update_timestamp(timestamp, pps, maxdelay):
  72. """
  73. Calculates the next timestamp to be used based on the packet per second rate (pps) and the maximum delay.
  74. :return: Timestamp to be used for the next packet.
  75. """
  76. return timestamp + uniform(1 / pps, maxdelay)
  77. # Aidmar
  78. def getIntervalPPS(complement_interval_pps, timestamp):
  79. """
  80. Gets the packet rate (pps) in specific time interval.
  81. :return: the corresponding packet rate for packet rate (pps) .
  82. """
  83. for row in complement_interval_pps:
  84. if timestamp <= row[0]:
  85. return row[1]
  86. return complement_interval_pps[-1][1] # in case the timstamp > capture max timestamp
  87. # Timestamp
  88. timestamp_next_pkt = self.get_param_value(Param.INJECT_AT_TIMESTAMP)
  89. # TO-DO: find better pkt rate
  90. pps = self.get_param_value(Param.PACKETS_PER_SECOND)
  91. randomdelay = Lea.fromValFreqsDict({1 / pps: 70, 2 / pps: 30, 5 / pps: 15, 10 / pps: 3})
  92. # Aidmar - calculate complement packet rates of BG traffic per interval
  93. complement_interval_pps = self.statistics.calculate_complement_packet_rates(pps)
  94. # Initialize parameters
  95. packets = []
  96. mac_source = self.get_param_value(Param.MAC_SOURCE)
  97. ip_source = self.get_param_value(Param.IP_SOURCE)
  98. mac_destination = self.get_param_value(Param.MAC_DESTINATION)
  99. ip_destination = self.get_param_value(Param.IP_DESTINATION)
  100. target_host = self.get_param_value(Param.TARGET_HOST)
  101. target_uri = self.get_param_value(Param.TARGET_URI)
  102. # Check ip.src == ip.dst
  103. if ip_source == ip_destination:
  104. print("\nERROR: Invalid IP addresses; source IP is the same as destination IP: " + ip_source + ".")
  105. import sys
  106. sys.exit(0)
  107. path_attack_pcap = None
  108. minDelay, maxDelay = self.get_reply_delay(ip_destination)
  109. # Inject Joomla_registration_privesc
  110. # Read joomla_registration_privesc pcap file
  111. orig_ip_dst = None
  112. exploit_raw_packets = RawPcapReader("resources/joomla_registration_privesc.pcap")
  113. port_source = randint(self.minDefaultPort,self.maxDefaultPort) # experiments show this range of ports
  114. # Random TCP sequence numbers
  115. global attacker_seq
  116. attacker_seq = randint(1000,50000)
  117. global victim_seq
  118. victim_seq = randint(1000,50000)
  119. for pkt_num, pkt in enumerate(exploit_raw_packets):
  120. eth_frame = Ether(pkt[0])
  121. ip_pkt = eth_frame.payload
  122. tcp_pkt = ip_pkt.payload
  123. str_tcp_seg = str(tcp_pkt.payload)
  124. # Clean payloads
  125. eth_frame.payload = b''
  126. ip_pkt.payload = b''
  127. tcp_pkt.payload = b''
  128. if pkt_num == 0:
  129. prev_orig_port_source = tcp_pkt.getfieldval("sport")
  130. if tcp_pkt.getfieldval("dport") == self.http_port:
  131. orig_ip_dst = ip_pkt.getfieldval("dst") # victim IP
  132. # Request: Attacker --> vicitm
  133. if ip_pkt.getfieldval("dst") == orig_ip_dst: # victim IP
  134. # There are 7 TCP connections with different source ports, for each of them we generate random port
  135. if tcp_pkt.getfieldval("sport") != prev_orig_port_source:
  136. port_source = randint(self.minDefaultPort, self.maxDefaultPort)
  137. prev_orig_port_source = tcp_pkt.getfieldval("sport")
  138. # New connection, new random TCP sequence numbers
  139. attacker_seq = randint(1000, 50000)
  140. victim_seq = randint(1000, 50000)
  141. # First packet in a connection has ACK = 0
  142. tcp_pkt.setfieldval("ack", 0)
  143. # Ether
  144. eth_frame.setfieldval("src", mac_source)
  145. eth_frame.setfieldval("dst", mac_destination)
  146. # IP
  147. ip_pkt.setfieldval("src", ip_source)
  148. ip_pkt.setfieldval("dst", ip_destination)
  149. # TCP
  150. tcp_pkt.setfieldval("sport",port_source)
  151. if len(str_tcp_seg) > 0:
  152. # convert payload bytes to string => str = "b'..\\r\\n..'" additional characters are added in the string,
  153. # mainly backslashes to escape single quotes and whitespaces
  154. str_tcp_seg = str_tcp_seg[2:-1]
  155. str_tcp_seg = str_tcp_seg.replace('/joomla360', target_uri)
  156. str_tcp_seg = str_tcp_seg.replace(orig_ip_dst, target_host)
  157. str_tcp_seg = str_tcp_seg.replace("\\n", "\n")
  158. str_tcp_seg = str_tcp_seg.replace("\\r", "\r")
  159. str_tcp_seg = str_tcp_seg.replace("\\t", "\t")
  160. str_tcp_seg = str_tcp_seg.replace("\\\'", "\'")
  161. # TCP Seq, Ack
  162. if tcp_pkt.getfieldval("ack") != 0:
  163. tcp_pkt.setfieldval("ack", victim_seq)
  164. tcp_pkt.setfieldval("seq", attacker_seq)
  165. if not(tcp_pkt.getfieldval("flags") == 16 and len(str_tcp_seg) == 0): # flags=A:
  166. attacker_seq += max(len(str_tcp_seg),1)
  167. new_pkt = (eth_frame / ip_pkt/ tcp_pkt / str_tcp_seg)
  168. new_pkt.time = timestamp_next_pkt
  169. maxdelay = randomdelay.random()
  170. pps = self.minDefaultPPS if getIntervalPPS(complement_interval_pps, timestamp_next_pkt) is None else max(
  171. getIntervalPPS(complement_interval_pps, timestamp_next_pkt), self.minDefaultPPS)
  172. timestamp_next_pkt = update_timestamp(timestamp_next_pkt, pps, maxdelay)
  173. # Reply: Victim --> attacker
  174. else:
  175. # Ether
  176. eth_frame.setfieldval("src", mac_destination)
  177. eth_frame.setfieldval("dst", mac_source)
  178. # IP
  179. ip_pkt.setfieldval("src", ip_destination)
  180. ip_pkt.setfieldval("dst", ip_source)
  181. # TCP
  182. tcp_pkt.setfieldval("dport", port_source)
  183. if len(str_tcp_seg) > 0:
  184. # convert payload bytes to string => str = "b'..\\r\\n..'" additional characters are added in the string,
  185. # mainly backslashes to escape single quotes and whitespaces
  186. str_tcp_seg = str_tcp_seg[2:-1]
  187. str_tcp_seg = str_tcp_seg.replace('/joomla360', target_uri)
  188. str_tcp_seg = str_tcp_seg.replace(orig_ip_dst, target_host)
  189. str_tcp_seg = str_tcp_seg.replace("\\n", "\n")
  190. str_tcp_seg = str_tcp_seg.replace("\\r", "\r")
  191. str_tcp_seg = str_tcp_seg.replace("\\t", "\t")
  192. str_tcp_seg = str_tcp_seg.replace("\\\'", "\'")
  193. # TCP Seq, ACK
  194. tcp_pkt.setfieldval("ack", attacker_seq)
  195. tcp_pkt.setfieldval("seq", victim_seq)
  196. strLen = len(str_tcp_seg)
  197. if not(tcp_pkt.getfieldval("flags") == 16 and strLen == 0): # flags=A:
  198. victim_seq += max(strLen, 1)
  199. new_pkt = (eth_frame / ip_pkt / tcp_pkt / str_tcp_seg)
  200. timestamp_next_pkt = timestamp_next_pkt + uniform(minDelay, maxDelay)
  201. new_pkt.time = timestamp_next_pkt
  202. packets.append(new_pkt)
  203. # Store timestamp of first packet (for attack label)
  204. self.attack_start_utime = packets[0].time
  205. self.attack_end_utime = packets[-1].time
  206. if len(packets) > 0:
  207. packets = sorted(packets, key=lambda pkt: pkt.time)
  208. path_attack_pcap = self.write_attack_pcap(packets, True, path_attack_pcap)
  209. # return packets sorted by packet time_sec_start
  210. # pkt_num+1: because pkt_num starts at 0
  211. return pkt_num + 1, path_attack_pcap