{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6347","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6347/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6347/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6347/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/6347","id":122093415,"number":6347,"title":"[Request] Critical 0day RCE in joomla","user":{"login":"madmike33","id":15649710,"avatar_url":"https://avatars.githubusercontent.com/u/15649710?v=3","gravatar_id":"","url":"https://api.github.com/users/madmike33","html_url":"https://github.com/madmike33","followers_url":"https://api.github.com/users/madmike33/followers","following_url":"https://api.github.com/users/madmike33/following{/other_user}","gists_url":"https://api.github.com/users/madmike33/gists{/gist_id}","starred_url":"https://api.github.com/users/madmike33/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/madmike33/subscriptions","organizations_url":"https://api.github.com/users/madmike33/orgs","repos_url":"https://api.github.com/users/madmike33/repos","events_url":"https://api.github.com/users/madmike33/events{/privacy}","received_events_url":"https://api.github.com/users/madmike33/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/hotness","name":"hotness","color":"8A0808"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":32,"created_at":"2015-12-14T17:43:52Z","updated_at":"2015-12-15T08:58:15Z","closed_at":null,"body":"@jvoisin r u interested mate\r\n\r\nThis is a serious vulnerability that can be easily exploited and is already in the wild. http://hubs.ly/H01B2K20"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/164690826","html_url":"https://github.com/rapid7/metasploit-framework/issues/6347#issuecomment-164690826","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6347","id":164690826,"user":{"login":"mmetince","id":4004716,"avatar_url":"https://avatars.githubusercontent.com/u/4004716?v=3","gravatar_id":"","url":"https://api.github.com/users/mmetince","html_url":"https://github.com/mmetince","followers_url":"https://api.github.com/users/mmetince/followers","following_url":"https://api.github.com/users/mmetince/following{/other_user}","gists_url":"https://api.github.com/users/mmetince/gists{/gist_id}","starred_url":"https://api.github.com/users/mmetince/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmetince/subscriptions","organizations_url":"https://api.github.com/users/mmetince/orgs","repos_url":"https://api.github.com/users/mmetince/repos","events_url":"https://api.github.com/users/mmetince/events{/privacy}","received_events_url":"https://api.github.com/users/mmetince/received_events","type":"User","site_admin":false},"created_at":"2015-12-15T08:58:15Z","updated_at":"2015-12-15T08:58:15Z","body":"@brandonprry You User-Agent has to be start or end with double quote in order to do string escaping at serialized string. Also you payload has to end with some special characters that latin-1 does NOT support  like ð . \r\n\r\nFor example : \r\nUser-Agent : TEST\r\n\r\nSerialized string is :\r\n```\r\n __default|a:8:{s:15:\"session.counter\";i:1;s:19:\"session.timer.start\";i:1450169533;s:18:\"session.timer.last\";i:1450169533;s:17:\"session.timer.now\";i:1450169533;s:22:\"session.client.browser\";s:4:\"TEST\";s:8:\"registry\";O:24:\"Joomla\\Registry\\Registry\":2:{s:7:\"\\0\\0\\0data\";O:8:\"stdClass\":0:{}s:9:\"separator\";s:1:\".\";}s:4:\"user\";O:5:\"JUser\":26:{s:9:\"\\0\\0\\0isRoot\";b:0;s:2:\"id\";i:0;s:4:\"name\";N;s:8:\"username\";N;s:5:\"email\";N;s:8:\"password\";N;s:14:\"password_clear\";s:0:\"\";s:5:\"block\";N;s:9:\"sendEmail\";i:0;s:12:\"registerDate\";N;s:13:\"lastvisitDate\";N;s:10:\"activation\";N;s:6:\"params\";N;s:6:\"groups\";a:1:{i:0;s:1:\"9\";}s:5:\"guest\";i:1;s:13:\"lastResetTime\";N;s:10:\"resetCount\";N;s:12:\"requireReset\";N;s:10:\"\\0\\0\\0_params\";O:24:\"Joomla\\Registry\\Registry\":2:{s:7:\"\\0\\0\\0data\";O:8:\"stdClass\":0:{}s:9:\"separator\";s:1:\".\";}s:14:\"\\0\\0\\0_authGroups\";a:2:{i:0;i:1;i:1;i:9;}s:14:\"\\0\\0\\0_authLevels\";a:3:{i:0;i:1;i:1;i:1;i:2;i:5;}s:15:\"\\0\\0\\0_authActions\";N;s:12:\"\\0\\0\\0_errorMsg\";N;s:13:\"\\0\\0\\0userHelper\";O:18:\"JUserWrapperHelper\":0:{}s:10:\"\\0\\0\\0_errors\";a:0:{}s:3:\"aid\";i:0;}s:16:\"com_mailto.links\";a:4:{s:40:\"864263691cf020260fd769f9e91b5152c4a0e278\";O:8:\"stdClass\":2:{s:4:\"link\";s:54:\"http://127.0.0.1:8181/index.php/3-welcome-to-your-blog\";s:6:\"expiry\";i:1450169533;}s:40:\"a7425dbaaa274c9c71da73ebdfc40ed0e1941365\";O:8:\"stdClass\":2:{s:4:\"link\";s:54:\"http://127.0.0.1:8181/index.php/4-about-your-home-page\";s:6:\"expiry\";i:1450169533;}s:40:\"50717150dd908262db5e49b4334dcc7f2d3bd0dd\";O:8:\"stdClass\":2:{s:4:\"link\";s:47:\"http://127.0.0.1:8181/index.php/6-your-template\";s:6:\"expiry\";i:1450169533;}s:40:\"78e8cf066aacebaecd359c665129e4281e269205\";O:8:\"stdClass\":2:{s:4:\"link\";s:46:\"http://127.0.0.1:8181/index.php/5-your-modules\";s:6:\"expiry\";i:1450169533;}}}\r\n```\r\n\r\nPlease look at where TEST is located. \r\n\r\nUser-Agent is : TESTð  (ending with none valid character for latin-1)\r\nSerialized string is:\r\n```\r\n__default|a:8:{s:15:\"session.counter\";i:1;s:19:\"session.timer.start\";i:1450169650;s:18:\"session.timer.last\";i:1450169650;s:17:\"session.timer.now\";i:1450169650;s:22:\"session.client.browser\";s:5:\"TEST\r\n```\r\nAs you can see, rest of the serialized string is omitted! because of MySQL behavior ( it remind one of the Wordpress stored XSS. ) That is the our entry point. Also as I said before our payload need to end/start with double quote in order to do another trick which is escaping!\r\n\r\nUser Agent is : TEST\"ð \r\n\r\nSerialized string is : \r\n```\r\n__default|a:8:{s:15:\"session.counter\";i:1;s:19:\"session.timer.start\";i:1450169799;s:18:\"session.timer.last\";i:1450169799;s:17:\"session.timer.now\";i:1450169799;s:22:\"session.client.browser\";s:6:\"TEST\"\r\n```\r\nThen we are free to define our serialized object that carry payload through MySQLDriver class."}}